- stunnel-users - stunnel.org

stunnel-4.20 server loop on AIX 5.3
by Peter Heimann 28 May '07

28 May '07

Under heavy usage, stunnel-4.20 on AIX 5.3 enters into a loop with high CPU load. Test setup: client ------------> gateway ------------> server ApacheBench 2.0.40-dev stunnel-4.20 Apache 1.3 in server mode OpenSSL 0.9.8d stunnel 4.20 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8d 28 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 ; stunnel configuration file, server mode cert = /etc/stunnel.pem setuid = stunnel setgid = stunnel pid = /tmp/stunnel.pid debug = local3.notice output = /tmp/stunnel.log [https] accept = gateway:4433 connect = server:80 The first client requests are processed without error, then some connections fail: % ab -n 1000 -c 70 https://gateway:4433/ This is ApacheBench, Version 2.0.40-dev <$Revision: 1.146 $> apache-2.0 [...] Test aborted after 10 failures Apr_socket_connect(): Invalid argument (22) Total of 705 requests completed One or more connections stay in state CLOSE_WAIT, and stunnel is chewing away CPU cycles (CPU usage >99%). % lsof -a -i -c stunnel COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME stunnel 196856 stunnel 6u IPv4 0xf100020002feeb98 0t0 TCP gateway:4433 (LISTEN) stunnel 196856 stunnel 46u IPv4 0xf100020002e98398 0t0 TCP gateway:4433 ->server:50271 (CLOSE_WAIT) In this state, attaching a debugger shows that stunnel is stuck in a loop in init_ssl() within client.c: +321 while(1) { +322 if(c->opt->option.client) +323 i=SSL_connect(c->ssl); +324 else +325 i=SSL_accept(c->ssl); +326 err=SSL_get_error(c->ssl, i); /* err==5 */ /* ... */ +349 if(err==SSL_ERROR_SYSCALL) { +350 switch(get_last_socket_error()) { +351 case EINTR: +353 case EAGAIN: /* loop continues */ +354 continue; +355 } +356 } SSL_accept() returns with error, SSL_get_error() returns 5 (SSL_ERROR_SYSCALL). get_last_socket_error() returns EAGAIN, and the loop continues without end. Nevertheless, new connection requests still get processed. Even before CPU usage goes up, for every new connection, SSL_accept() results in SSL_ERROR_SYSCALL for 20 to 1800 times before finally data is exchanged. stunnel enters this endless loop on AIX both with OpenSSL 0.9.8d and OpenSSL 0.9.8e. If I replace the AIX gateway machine with one running stunnel-4.20 on Solaris, I do not experience any problems. What might trigger this loop on AIX 5.3? How can it be avoided? -- Peter Heimann _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

Reconfiguration while running
by James Moe 28 May '07

28 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Does Stunnel offer a way to reload the configuration file? Usually that is done with SIGHUP but the code looks like it just terminates. Does it have a way to sense that the conf has changed and reloads it? Or must Stunnel be terminated and restarted? - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFGWhbJzTcr8Prq0ZMRAoy8AJ4ocDWfBEvEfoIYoypURg2hTxUh0gCfajo1 nVXpKD5iBFEx6ZHauPemnsU= =vGul -----END PGP SIGNATURE-----

1 0

Quick question relating to end to end encryption with hapoxy:
by lists 27 May '07

27 May '07

I'm using stunnel to decrypt HTTPS and pass it to HAPROXY to insert a cookie and it works very well and very fast. Is their a way of making HAPROXY talk to the backend servers in HTTPS? i.e.. End to end encryption. Can I re-direct it back through stunnel in reverse? Thanks in advance, Malcolm.

2 1

Brocken Connections
by Manfred Alfaré 25 May '07

25 May '07

Hi! I have some trouble using STUNNEL on WIN98 to secure connections to HFS (Http File Server), and hope, somebody can help me. I can connect to HFS with the Browser (Firefox 2.0.0.3, IE 6.0, on the same machine HFS is running, an other one in LAN and a third via internet) and download files, bat every downloaded File is corrupt. In most cases, transfer seems to terminate normally, but the downloaded file ist to short, sometimes there is popup, that tells me, that the file could not be read, because the connection is broken. The log file shows the following: ********************************* stunnel 4.20 on x86-pc-mingw32-gnu with OpenSSL 0.9.8d 28 Sep 2006 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 No limit detected for the number of clients https accepted connection from 85.127.28.154:63819 https connected remote server from 127.0.0.1:1287 Connection closed: 1632 bytes sent to SSL, 476 bytes sent to socket https accepted connection from 85.127.28.154:63821 https accepted connection from 85.127.28.154:63823 https connected remote server from 127.0.0.1:1290 https connected remote server from 127.0.0.1:1291 Connection closed: 919 bytes sent to SSL, 349 bytes sent to socket Connection closed: 720 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63825 https accepted connection from 85.127.28.154:63827 https connected remote server from 127.0.0.1:1294 https connected remote server from 127.0.0.1:1295 Connection closed: 715 bytes sent to SSL, 402 bytes sent to socket Connection closed: 277 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63829 https connected remote server from 127.0.0.1:1297 Connection closed: 269 bytes sent to SSL, 402 bytes sent to socket https accepted connection from 85.127.28.154:63831 https connected remote server from 127.0.0.1:1299 Connection closed: 920 bytes sent to SSL, 349 bytes sent to socket https accepted connection from 85.127.28.154:63833 https connected remote server from 127.0.0.1:1301 https accepted connection from 85.127.28.154:63835 https connected remote server from 127.0.0.1:1303 Connection closed: 920 bytes sent to SSL, 349 bytes sent to socket readsocket: Connection reset by peer (WSAECONNRESET) (10054) Connection reset: 1289938 bytes sent to SSL, 481 bytes sent to socket ************************* My STUNNEL.CONF looks like this: ******************************** ; File with certificate and private key cert = stunnel.pem key = stunnel.pem ; Log (1= minimal, 5=recommended, 7=all) and log file) ; Preceed with a ";" to disable logging debug = 5 output = stunnel.log ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Data compression algorithm: zlib or rle compression = zlib ; SSL bug options / NO SSL:v2 (SSLv3 and TLSv1 is enabled) options = ALL options = NO_SSLv2 ; Service-level configuration ; Stunnel listens to port 443 (HTTPS) to any IP ; and connects to port 44300 (HFS) on localhost [https] accept = 0.0.0.0:443 connect = 127.0.0.1:44300 TIMEOUTclose = 0 ************************************* Your help will be appreciated. Regards Manfred Alfare (not a native englisch speaker :-(

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 5
by GNUtoo＠no-log.org 23 May '07

23 May '07

> >>> in cygwin i have the following errors: >>> $ openssl req -new -x509 -days 365 -nodes -config >>> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >>> Generating a 512 bit RSA private key >>> ..++++++++++++ >>> .....++++++++++++ >>> writing new private key to 'stunnel.pem' >>> ----- >>> unable to find 'distinguished_name' in config >>> problems making Certificate Request >>> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >>> value:conf_lib.c:329:group=req name=distinguished_name >>> >>> $ /usr/bin/stunnel.exe >>> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >>> /etc/stunnel/mail.pem >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >>> /etc/stunnel/stunnel.pem >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >>> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >>> 2007.05.13 22:37:12 LOG3[2188:6422536]: >>> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >>> routines:PEM_read_bio:no start line >>> >>> and i ran all as Administrator >> >> Can you please post your /etc/stunnel/stunnel.conf, and also the results >> of >> 'ls -al /etc/stunnel'. Thanks, Andrew. >> > $ ls -al /etc/stunnel/ > total 6 > drwx------+ 2 FC1 Users 0 May 13 22:37 . > drwx------+ 11 FC1 Users 0 May 13 21:56 .. > lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> > stunnel.pem > -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf > -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample > -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem > > > $ cat /etc/stunnel/stunnel.conf > #; Sample stunnel configuration file by Michal Trojnara 2002-2006 > #; Some options used here may not be adequate for your particular > configuration > #; Please make sure you understand them (especially the effect of chroot > jail) > > #; Certificate/key is needed in server mode and optional in client mode > #;cert = /etc/stunnel/mail.pem > key = /etc/stunnel/mail.pem > > #; Protocol version (all, SSLv2, SSLv3, TLSv1) > sslVersion = SSLv3 > > #; Some security enhancements for UNIX systems - comment them out on Win32 > chroot = /var/lib/stunnel/ > setuid = nobody > setgid = nobody > #; PID is created inside chroot jail > pid = /stunnel.pid > > #; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > #;compression = rle > > #; Workaround for Eudora bug > #;options = DONT_INSERT_EMPTY_FRAGMENTS > > #; Authentication stuff > #;verify = 2 > #; Don't forget to c_rehash CApath > #; CApath is located inside chroot jail > #;CApath = /certs > #; It's often easier to use CAfile > #;CAfile = /etc/stunnel/certs.pem > #; Don't forget to c_rehash CRLpath > #; CRLpath is located inside chroot jail > #;CRLpath = /crls > #; Alternatively you can use CRLfile > #;CRLfile = /etc/stunnel/crls.pem > > #; Some debugging stuff useful for troubleshooting > #;debug = 7 > #;output = stunnel.log > > #; Use it for client mode > #;client = yes > > #; Service-level configuration > > #;[pop3s] > #;accept = 995 > #;connect = 110 > > #;[imaps] > #;accept = 993 > #;connect = 143 > > #;[ssmtp] > #;accept = 465 > #;connect = 25 > > #;[https] > ##;accept = 443 > #;connect = 80 > #;TIMEOUTclose = 0 > > #; vim:ft=dosini > > [vnc] > accept = 127.0.0.1:5500 > connect = 192.168.1.107:443 now that i have posted the config file...do i need to post something else?

2 1

Re: [stunnel-users] Simple SMTP encryption
by Hans Werner Strube 21 May '07

21 May '07

James Moe wrote: > client = yes > > [smtps] > accept = 127.0.0.1:465 > connect = smtpauth.earthlink.net:25 > > I missed the part somewhere that tells Stunnel to issue a STARTTLS to > the smtp server before attempting to negotiate a TLS connection. Add (under [smtps]): protocol = smtp

1 0

Simple SMTP encryption
by James Moe 19 May '07

19 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, stunnel 4.20 with OpenSSL 0.9.8d 28 Sep 2006 I wish have my MUA to send messages encrypted to a secure mail server. Stunnel is set up as a client with the following configuration: client = yes [smtps] accept = 127.0.0.1:465 connect = smtpauth.earthlink.net:25 I missed the part somewhere that tells Stunnel to issue a STARTTLS to the smtp server before attempting to negotiate a TLS connection. The "failed handshake" bit is because the server is rejecting the command because of NULLs in the text stream. 501 NULL characters are not allowed in SMTP commands. Then there is the "wrong version" error. I suppose that is a side effect of the handshake failure? Here is a typical connection log: 2007.05.19 12:52:42 LOG7[232:4239]: smtps accepted FD=12 from 127.0.0.1:52672 2007.05.19 12:52:42 LOG7[232:4239]: Creating a new thread 2007.05.19 12:52:42 LOG7[232:4239]: New thread created 2007.05.19 12:52:42 LOG7[264:4239]: smtps started 2007.05.19 12:52:42 LOG7[264:4239]: FD 12 in non-blocking mode 2007.05.19 12:52:42 LOG7[264:4239]: TCP_NODELAY option set on local socket 2007.05.19 12:52:42 LOG5[264:4239]: smtps accepted connection from 127.0.0.1:52672 2007.05.19 12:52:42 LOG7[264:4239]: FD 15 in non-blocking mode 2007.05.19 12:52:42 LOG7[264:4239]: smtps connecting 207.69.189.201:25 2007.05.19 12:52:42 LOG7[264:4239]: connect_wait: waiting 10 seconds 2007.05.19 12:52:42 LOG7[264:4239]: connect_wait: connected 2007.05.19 12:52:42 LOG5[264:4239]: smtps connected remote server from 192.168.69.14:52673 2007.05.19 12:52:42 LOG7[264:4239]: Remote FD=15 initialized 2007.05.19 12:52:42 LOG7[264:4239]: TCP_NODELAY option set on remote socket 2007.05.19 12:52:42 LOG7[264:4239]: SSL state (connect): before/connect initialization 2007.05.19 12:52:42 LOG7[264:4239]: SSL state (connect): SSLv3 write client hello A 2007.05.19 12:52:42 LOG7[264:4239]: SSL alert (write): fatal: handshake failure 2007.05.19 12:52:42 LOG3[264:4239]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2007.05.19 12:52:42 LOG5[264:4239]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.05.19 12:52:42 LOG7[264:4239]: smtps finished (0 left) - -- jimoe (at) sohnen-moe (dot) com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (OS/2) iD8DBQFGT1lQzTcr8Prq0ZMRAv50AJ9Kydmi3F/VBQ8hvpr+HmodUZhJEgCfQjbz TRdvnzpATUH/y3gzA1EXMYo= =jTqm -----END PGP SIGNATURE-----

1 0

Several connections on a short period of time problem
by Teigao, Rafael Coninck 16 May '07

16 May '07

Hi, I'm running Stunnel 4.20 to connect a Win client to a Win server. On the server it runs as a service, but on the client side I call it every time a connection is requested with a different config file (I need dynamic configuration) If I connect, disconnect and connect again very quickly (say, in 10 seconds), the fourth time (usually) that I try to connect will give me error 10060 (timeout) on the client application (not Stunnel). Does Stunnel restrict the amount of connection from the same client based on time or something like that? Thanks, Rafael.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 4
by GNUtoo＠no-log.org 15 May '07

15 May '07

>> in cygwin i have the following errors: >> $ openssl req -new -x509 -days 365 -nodes -config >> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >> Generating a 512 bit RSA private key >> ..++++++++++++ >> .....++++++++++++ >> writing new private key to 'stunnel.pem' >> ----- >> unable to find 'distinguished_name' in config >> problems making Certificate Request >> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >> value:conf_lib.c:329:group=req name=distinguished_name >> >> $ /usr/bin/stunnel.exe >> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >> /etc/stunnel/mail.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >> /etc/stunnel/stunnel.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >> 2007.05.13 22:37:12 LOG3[2188:6422536]: >> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >> routines:PEM_read_bio:no start line >> >> and i ran all as Administrator > > Can you please post your /etc/stunnel/stunnel.conf, and also the results > of > 'ls -al /etc/stunnel'. Thanks, Andrew. > $ ls -al /etc/stunnel/ total 6 drwx------+ 2 FC1 Users 0 May 13 22:37 . drwx------+ 11 FC1 Users 0 May 13 21:56 .. lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> stunnel.pem -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem $ cat /etc/stunnel/stunnel.conf #; Sample stunnel configuration file by Michal Trojnara 2002-2006 #; Some options used here may not be adequate for your particular configuration #; Please make sure you understand them (especially the effect of chroot jail) #; Certificate/key is needed in server mode and optional in client mode #;cert = /etc/stunnel/mail.pem key = /etc/stunnel/mail.pem #; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 #; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel/ setuid = nobody setgid = nobody #; PID is created inside chroot jail pid = /stunnel.pid #; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #;compression = rle #; Workaround for Eudora bug #;options = DONT_INSERT_EMPTY_FRAGMENTS #; Authentication stuff #;verify = 2 #; Don't forget to c_rehash CApath #; CApath is located inside chroot jail #;CApath = /certs #; It's often easier to use CAfile #;CAfile = /etc/stunnel/certs.pem #; Don't forget to c_rehash CRLpath #; CRLpath is located inside chroot jail #;CRLpath = /crls #; Alternatively you can use CRLfile #;CRLfile = /etc/stunnel/crls.pem #; Some debugging stuff useful for troubleshooting #;debug = 7 #;output = stunnel.log #; Use it for client mode #;client = yes #; Service-level configuration #;[pop3s] #;accept = 995 #;connect = 110 #;[imaps] #;accept = 993 #;connect = 143 #;[ssmtp] #;accept = 465 #;connect = 25 #;[https] ##;accept = 443 #;connect = 80 #;TIMEOUTclose = 0 #; vim:ft=dosini [vnc] accept = 127.0.0.1:5500 connect = 192.168.1.107:443

1 0

certs problems in cygwin
by GNUtoo＠no-log.org 14 May '07

14 May '07

in cygwin i have the following errors: $ openssl req -new -x509 -days 365 -nodes -config /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem Generating a 512 bit RSA private key ..++++++++++++ .....++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=req name=distinguished_name $ /usr/bin/stunnel.exe 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on /etc/stunnel/mail.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: /etc/stunnel/stunnel.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 22:37:12 LOG3[2188:6422536]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line and i ran all as Administrator

2 1

with the windows version it isn't better...same kind of errors
by GNUtoo＠no-log.org 13 May '07

13 May '07

C:\Programmi\openssl>openssl.exe req -new -x509 -days 365 -nodes -config stunnel .conf -out stunnel.pem -keyout stunnel.pem Loading 'screen' into random state - done Generating a 512 bit RSA private key .....++++++++++++ .......................++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1772:error:0E06D06C:configuration file routines:NCONF_get_string:no value:./cryp to/conf/conf_lib.c:329:group=req name=distinguished_name 2007.05.13 23:05:03 LOG3[304:860]: Error resolving 'VNC_client_IP_address': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'VNC_client_IP_address:443' - delaying DNS lookup 2007.05.13 23:05:03 LOG3[304:860]: Error reading certificate file: stunnel.pem 2007.05.13 23:05:03 LOG3[304:860]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 23:05:03 LOG3[304:860]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2007.05.13 23:05:03 LOG3[304:860]: Server is down

1 0

RTMPS
by Grant Kohler 11 May '07

11 May '07

Has anybody had any luck getting RTMP and stunnel to work together with RTMPS? Thanks, -Grant

1 0

Stunnel-Mozilla Thunderbird 2.0 and Spampal
by Jim 01 May '07

01 May '07

2 1

RE: [stunnel-users] Vista not connecting to port 139
by Neil Aggarwal 29 Apr '07

29 Apr '07

Alaric: This is strange. When I go to the Security Center, it says the McAfee Personal Firewall is on, but I can't find it in the Start menu, Services, or anywhere else. Any ideas? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. -----Original Message----- From: Alaric Dailey [mailto:[email protected]] Sent: Thursday, April 26, 2007 3:48 PM To: 'Neil Aggarwal' Subject: RE: [stunnel-users] Vista not connecting to port 139 I would check the windows firewall, or any other security suite you may have. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Neil Aggarwal Sent: Thursday, April 26, 2007 15:30 To: stunnel-users(a)mirt.net Subject: [stunnel-users] Vista not connecting to port 139 Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 27 Apr '07

27 Apr '07

RUTSCHLE Yves wrote: > Argh. After removing all my debugging printf's, it turns out it doesn't seem > to work after all. Which, if it has to do with signals and timing, is only > partly surprising. Ok, nothing to do with any of that. Deep inside OpenSSL, there is a call to gmtime_r. Deep somewhere in hell (I hope), someone decided that LynxOS' gmtime_r functions would have its arguments *reversed*. REVERSED. I guess they were going for SIXPO complience. So that call would write rubbish in the stack, hence no returning from the call and segfault instead. So, nothing to do with stunnel after all. Thanks for the support anyway! :) Y. - TGIFriday

1 0

[PATCH?] Senting a list of accepted CAs to the client
by Miloslav Trmac 27 Apr '07

27 Apr '07

Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001#c20 . Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek

1 0

Vista not connecting to port 139
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

1 0

Stunnel on Vista
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: Has anyone used stunnel on Vista? For some stupid reason, it tells me I can't save the stunnel.conf file. Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 2

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Michal Trojnara wrote: >Some systems require to reset signal handler each time a signal was >received, while for others the handler is executed recursively destroying >CPU stack of running stunnel process. Ah. That'd explain it. Thanks for the tip and the explanations! Y.

1 0

Handshake failure
by RUTSCHLE Yves 26 Apr '07

26 Apr '07

Hello, I am trying to set up a stunnel between two machines running LynxOS, which is a POSIX derivative. I've compiled OpenSSL 0.9.8e, and stunnel 4.20: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 [...] I use the following config files: ////// server side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 [SSLTunnel] accept=1235 connect=1234 ////// end server side ////// client side debug=7 foreground=yes pid= CAfile=valid_certs key=privkey.pem cert=cert.pem verify=1 client=yes [SSLTunnel] accept=4234 connect=173.16.1.10:1235 ////// end client side (It's run from different directories so the PEM files are different) After running both stunnels, I connect to the client side and see a beginning of handshake; however, it then breaks down: from afar, it looks like the client doesn't take the server certificate: ///// server trace 2007.04.25 15:33:22 LOG7[58:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:22 LOG7[58:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:22 LOG7[58:0]: PRNG seeded successfully 2007.04.25 15:33:22 LOG7[58:0]: Certificate: cert.pem 2007.04.25 15:33:22 LOG7[58:0]: Certificate loaded 2007.04.25 15:33:22 LOG7[58:0]: Key file: privkey.pem 2007.04.25 15:33:22 LOG7[58:0]: Private key loaded 2007.04.25 15:33:22 LOG7[58:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:22 LOG7[58:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:22 LOG7[58:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:22 LOG5[58:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:22 LOG5[58:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:22 LOG6[58:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:22 LOG6[58:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:22 LOG5[58:0]: 29 clients allowed 2007.04.25 15:33:22 LOG7[58:0]: FD 3 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 4 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: FD 5 in non-blocking mode 2007.04.25 15:33:22 LOG7[58:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:22 LOG7[58:0]: SSLTunnel bound to 0.0.0.0:1235 2007.04.25 15:33:22 LOG7[58:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:17 LOG7[58:0]: SSLTunnel accepted FD=6 from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSLTunnel started 2007.04.25 15:34:17 LOG7[68:0]: FD 6 in non-blocking mode 2007.04.25 15:34:17 LOG5[68:0]: SSLTunnel accepted connection from 173.16.1.7:1092 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): before/accept initialization 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 read client hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write server hello A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 write certificate request A 2007.04.25 15:34:17 LOG7[68:0]: SSL state (accept): SSLv3 flush data 2007.04.25 15:34:19 LOG3[68:0]: SSL_accept: Peer suddenly disconnected 2007.04.25 15:34:19 LOG5[68:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 15:34:19 LOG7[58:0]: Cleaning up the signal pipe 2007.04.25 15:34:19 LOG7[58:0]: Process 68 finished with code 0 (0 left) ///// end server trace ///// client trace 2007.04.25 15:33:59 LOG7[12:0]: Snagged 64 random bytes from /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: Wrote 1024 new random bytes to /home/st07815/.rnd 2007.04.25 15:33:59 LOG7[12:0]: RAND_status claims sufficient entropy for the PRNG 2007.04.25 15:33:59 LOG7[12:0]: PRNG seeded successfully 2007.04.25 15:33:59 LOG7[12:0]: Certificate: cert.pem 2007.04.25 15:33:59 LOG7[12:0]: Certificate loaded 2007.04.25 15:33:59 LOG7[12:0]: Key file: privkey.pem 2007.04.25 15:33:59 LOG7[12:0]: Private key loaded 2007.04.25 15:33:59 LOG7[12:0]: Loaded verify certificates from valid_certs 2007.04.25 15:33:59 LOG7[12:0]: Loaded valid_certs revocation lookup file 2007.04.25 15:33:59 LOG7[12:0]: SSL context initialized for service SSLTunnel 2007.04.25 15:33:59 LOG5[12:0]: stunnel 4.20 on i386-unknown-lynxos with OpenSSL 0.9.8e 23 Feb 2007 2007.04.25 15:33:59 LOG5[12:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv4 2007.04.25 15:33:59 LOG6[12:0]: file ulimit = 64 (can be changed with 'ulimit -n') 2007.04.25 15:33:59 LOG6[12:0]: poll() used - no FD_SETSIZE limit for file descriptors 2007.04.25 15:33:59 LOG5[12:0]: 29 clients allowed 2007.04.25 15:33:59 LOG7[12:0]: FD 3 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 4 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: FD 5 in non-blocking mode 2007.04.25 15:33:59 LOG7[12:0]: SO_REUSEADDR option set on accept socket 2007.04.25 15:33:59 LOG7[12:0]: SSLTunnel bound to 0.0.0.0:4234 2007.04.25 15:33:59 LOG7[12:0]: No pid file being created (end of init, waiting for connection) 2007.04.25 15:34:27 LOG7[12:0]: SSLTunnel accepted FD=6 from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel started 2007.04.25 15:34:27 LOG7[27:0]: FD 6 in non-blocking mode 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel accepted connection from 152.14.101.54:64752 2007.04.25 15:34:27 LOG7[27:0]: FD 5 in non-blocking mode 2007.04.25 15:34:27 LOG7[27:0]: SSLTunnel connecting 173.16.1.10:1235 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: waiting 10 seconds 2007.04.25 15:34:27 LOG7[27:0]: connect_wait: connected 2007.04.25 15:34:27 LOG5[27:0]: SSLTunnel connected remote server from 173.16.1.7:1092 2007.04.25 15:34:27 LOG7[27:0]: Remote FD=5 initialized 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): before/connect initialization 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 write client hello A 2007.04.25 15:34:27 LOG7[27:0]: SSL state (connect): SSLv3 read server hello A 2007.04.25 15:34:28 LOG7[12:0]: Cleaning up the signal pipe 2007.04.25 15:34:28 LOG7[12:0]: Process 27 terminated on signal 11 (0 left) ///// end client trace Now the strange thing is that this very same setup works on Solaris, so I have something wrong with the port of either OpenSSL or stunnel on LynxOS. If someone could give me a hint as to where to start poking, I'd greatly appreciate it. TIA, Y.

2 2

Stunnel with Goldmine 6.70.61214
by Raymond Randall 26 Apr '07

26 Apr '07

Greetings! Use Goldmine with Gmail domain services. Have set up according to Mike Casteel's instructions. However, Goldmine will not download email from the Gmail (the GMail address: rayrandall(a)ethosadvisory.com) Here is the stunnel.conf file: client=yes [pop3] accept=9995 connect=pop.gmail.com:995 [smtp] accept=465 connect=smtp.gmail.com:465 POP and SMTP set to: 127.0.0.1 Here is the stunnel report: 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'pop.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'pop.gmail.com:995' - delaying DNS lookup 2007.04.26 06:32:20 LOG3[1972:1996]: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'smtp.gmail.com:465' - delaying DNS lookup 2007.04.26 06:32:20 LOG5[1972:1996]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7e 25 Oct 2004 2007.04.26 06:32:20 LOG5[1972:1996]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.04.26 06:32:24 LOG5[1972:424]: No limit detected for the number of clients 2007.04.26 07:11:56 LOG5[1972:1204]: pop3 connected from 127.0.0.1:1600 2007.04.26 07:14:01 LOG5[1972:1204]: Connection closed: 2795 bytes sent to SSL, 662451 bytes sent to socket Perhaps this is a Goldmine configuration error. Not sure, and appreciate suggestions. Ray Randall -- Ethos Advisory Services Ray Randall 617-275-5565 Fax: 877-895-3756 http://www.ethosadvisory.com Information provided by Ethos is based on sources we believe reliable. Ethos does not offer legal or accounting services. Information contained in this email message is confidential and may contain privileged information. Any review or use of the information contained in this email message by persons other than the intended recipient(s) is prohibited. Content of this email is illustrative and educational; it is not a recommendation to purchase or sell. The examples presented do not take into consideration commissions, tax implications or other transaction costs, which may significantly affect the economic consequences of a given strategy. Mutual fund investing involves risk, including the possible loss of principal. Index performance returns do not reflect any management fees, transaction costs, or expenses. Past performance does not guarantee future results.

1 0

Connecting via rtmps to Red5 server
by David Schulberg 25 Apr '07

25 Apr '07

Hi, I have been led to stunnel as the way to get a Flash application to communicate securely with Red5 server. Red5 doesn't directly support ssl connectivity but using rtmps protocol (rtmp tunnelled via https) clients should be able to connect to Red5 if stunnel handles the encrypted traffic on port 443 and passes unencrypted communications back and forth to the Red5 on a port it expects to receive rtmp communication.. (refer http://www.adobe.com/devnet/flashcom/articles/firewalls_proxy04.html) The log file I get when I attempt to talk rtmps is shown below 2007.04.25 18:19:04 LOG7[3932:3384]: New thread created 2007.04.25 18:19:04 LOG7[3932:3664]: https started 2007.04.25 18:19:04 LOG7[3932:3664]: FD 224 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on local socket 2007.04.25 18:19:04 LOG5[3932:3664]: https accepted connection from 127.0.0.1:1249 2007.04.25 18:19:04 LOG7[3932:3664]: FD 248 in non-blocking mode 2007.04.25 18:19:04 LOG7[3932:3664]: https connecting 127.0.0.1:1935 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: waiting 10 seconds 2007.04.25 18:19:04 LOG7[3932:3664]: connect_wait: connected 2007.04.25 18:19:04 LOG5[3932:3664]: https connected remote server from 127.0.0.1:1250 2007.04.25 18:19:04 LOG7[3932:3664]: Remote FD=248 initialized 2007.04.25 18:19:04 LOG7[3932:3664]: TCP_NODELAY option set on remote socket 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): before/connect initialization 2007.04.25 18:19:04 LOG7[3932:3664]: SSL state (connect): SSLv3 write client hello A 2007.04.25 18:24:04 LOG6[3932:3664]: init_ssl: s_poll_wait timeout 2007.04.25 18:24:04 LOG5[3932:3664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.04.25 18:24:04 LOG7[3932:3664]: https finished (0 left) The stunnel.conf file has the following settings that pertain specifically to this situation client = yes [https] accept = 443 connect = 1935 What I seem to see (according to the logfile) is that an ssl connection is successfully established but no subsequent communication takes place after the connection has been made. At this point my Flash application doesn't send any messages via the ssl connection which seems to implicate my client as being the source of my problem. I would appreciate any advice on how I can best investigate this whole situation to resolve the issue. Regards, David Schulberg email: davids(a)evertech.com.au

2 2

firewall very restricted!!
by Pitoniso Rikito Rikin 17 Apr '07

17 Apr '07

Ok guys look this... my only contact with the world is trought the WEB port 80 how i can establish a ssh connection trought this port, the only method avaible is the GET or POST.... well how i do this... help --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

Using Client Authentication
by Ravi Gowda 16 Apr '07

16 Apr '07

Hi All, I am trying to have a setup where stunnel acts as a client to a server which requires client-Authentication. This is the snapshot of my stunnel.conf # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = nobody setgid = nobody output = /etc/stunnel/out cert = /etc/stunnel/rtca-client.pem key = /etc/stunnel/rtca-client.ky # Authentication stuff verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: CAfile = /etc/stunnel/rtca.pem ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:IDEA-CBC-SHA:IDEA-CBC-MD5:RC2-CBC-MD5:DHE-DSS-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:RC4-64-MD5:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EXP1024-RC2-CBC-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP1024-DHE-DSS-RC4-SHA:EXP1024-RC4-SHA:EXP1024-RC4-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 # Some debugging stuff debug = 7 output = /etc/stunnel/stunnel.log # Use it for client mode client = yes when I try to connect to the server, I am seeing that Stunnel is sending an empty certificate..which is making my server to reject connections. Can someone please help me out?? Thanks in Advance Ravi Gowda

1 0

Re: [stunnel-users] Setting up chain certificates on Stunnel.
by Hans Werner Strube 13 Apr '07

13 Apr '07

Satyajit Das wrote: > My server certificate > signed by intermediate CA > signed by Verisign CA > > I have the Verisign certificate on my clients trusted root CAs, however I am > > not able to get the SSL communication through. I believe this is because > stunnel should send all the three certificates for authentication and I > couldnt > configure stunnel to send across all the three certificates. > > Can anybody please help install all these certificates on stunnel. Simply concatenate the certificates (in PEM format) in the file specified by "cert = ..." and supply the key of your server certificate either in the same file or in the file specified by "key = ...".

1 0

stunnel-4.20 crash on AIX
by Peter O'Gorman 12 Apr '07

12 Apr '07

Hi, We built stunnel-4.20 on solaris, hpux, aix, tru64. irix and various linux hosts, and it works fine everywhere except hpux10.20 and aix. stunnel crashes with similar backtraces on AIX-4.3,5.1,5.2 and 5.3, not on the first client connect (using stunnel client=yes, connecting to s secure daytime server on another host, because everyone needs a secure daytime server :-p) but on the second connection. We have not tried server side yet, I assume results are similar. The backtrace looks like this: GDB: Program terminated with signal 11, Segmentation fault. #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) (gdb) bt #0 0xd0126b1c in _sigsetmask () from /usr/lib/libpthreads.a(shr_xpg5.o) #1 0xd0127e5c in _p_sigaction () from /usr/lib/libpthreads.a(shr_xpg5.o) #2 0xd0315544 in sigaction () from /usr/lib/libc.a(shr.o) #3 0xd038beac in signal () from /usr/lib/libc.a(shr.o) #4 0x10006200 in sigchld_handler (sig=0) at network.c:350 #5 0x00004378 in ?? () Previous frame inner to this frame (corrupt stack?) dbx: sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 sigchld_handler(sig = 0), line 350 in "network.c" _sigsetmask(??, ??, ??) at 0xd0126b1c _p_sigaction(??, ??, ??) at 0xd0127e58 raise.sigaction(??, ??, ??) at 0xd0315540 signal(??, ??) at 0xd038bea8 repeated forever. Line 350 of network.c says: signal(SIGCHLD, sigchld_handler); And that is in the signal handler, it seems like a normal thing to do, and I have no idea why, on AIX, it crashes. putting an #ifndef _AIX #endif around the signal() call "fixes" the crash, alternatively setting SIGCHLD to SIG_IGN on AIX "fixes" it, but I don't think that either solution is correct. I don't believe the signal handler will get called again as we do not reset the signal. (tests that assumtion and finds answer to riddle) Okay, problem identified. The signal_handler is being called repeatedly, causing an infinite loop that can only end in a crash. According to the AIX signal man page: The signal in libc.a does not set the SA_RESTART flag. It sets the signal mask to the signal whose action is being specified, and sets flags to SA_OLDSTYLE. The Berkeley Software Distribution (BSD) version of signal sets the SA_RESTART flag and preserves the current settings of the signal mask and flags. The BSD version can be used by compiling with the Berkeley Compatibility Library (libbsd.a). And indeed, no patches are required if I add -lbsd. Another solution would probably be to use sigaction if it is available. Meanwhile, please find attached a patch to add -lbsd on aix. Thanks for bearing with me while I figured this out :-) Peter

1 0

Setting up chain certificates on Stunnel.
by Satyajit Das 12 Apr '07

12 Apr '07

Hi , I am using stunnel as a wrapper to provide SSL functionalities for my server. Right now I am having problems setting up chained certificates on stunnel. My Problem -> My server certificate > signed by intermediate CA > signed by Verisign CA I have the Verisign certificate on my clients trusted root CAs, however I am not able to get the SSL communication through. I believe this is because stunnel should send all the three certificates for authentication and I couldnt configure stunnel to send across all the three certificates. Can anybody please help install all these certificates on stunnel. Thanks in advance, Satyajit

1 0

Cannot install stunnel as a service on Vista
by Neil Aggarwal 12 Apr '07

12 Apr '07

Hello: I cannot install stunnel as a service on Vista. I get a permission denied error. Is there a way to work around it? Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 1

forcing checking of local certificates every time
by san san 11 Apr '07

11 Apr '07

Hi, I am using stunnel with verify option with value 3. In value 3 the authentication is carried out using the local trusted certificates. I think stunnel does not check the local trusted certificates directory each and every time. If the connection has already been established then it does not check local trusted certificates , connection can be established using the certificates in cache. Is it possible to force to check the local trusted certificates every time. Regards

2 1

stunnel work with NAT
by atsushi kataoka 11 Apr '07

11 Apr '07

I have one question , does stunnel work with NAT ? I will explain the architecture There are some 10.0.0.XXXX machines and some are 192.0.0.XXXX machines. They are connected to each other via Router which does NAT. My VNC servers are installed on 10.0.0.XXXX and vnc clients on 192.0.0.XXXX I am not able to do the vnc from client to server. Now I want to encrypt the VNC traffic , can stunnel work with NAT? A Kataoka

1 0

running concurrent stunnel instances
by John Taylor 10 Apr '07

10 Apr '07

Greetings, I am running rsync through stunnel 4.20. Each end is a Dell dual cpu, dual core Xeon (each core with hyper-threading) 8 gigs of memory, running Win 2003 Server. The disks are 10K RPM Ultra-320 drives that use hardware raid-5. Right now, I have anywhere between 5 and 8 Scheduled Tasks running at the same time. The reason for this is that the backups need to run in parallel in order to finish within the 15 hour time window. Although I am not certain about an exact number, I believe I would be transferring about 300-400 gig of data each time. Even though I have a gigabit connection between the two servers, I am only seeing 5-6% network utilization. When running the same rsync batch file without stunnel encryption, the throughput was much higher. I would like to see about increasing my throughput with stunnel encryption running. I don't expect it to be as fast as running without stunnel, but I still think I should be able to do better than 5-6% throughput. I am also running a enhanced version of rsync that does not have any issues with NTFS disk fragmentation, since it preallocates the files to the final size before writing. I think the bottleneck is the CPU. To test out this theory, I would like to have multiple copies of the stunnel.exe running, each using their own config file and own port numbers. I don't think the problem is with rsync because it spawns a new process for each connection. Thus, the multiple rsync.exe processes get the advantage of running on top of multiple cores. This is not the case with stunnel.exe. It only uses 1 process, but 8 threads. I am hoping that multiple stunnel.exe instances will fix the bottleneck because each stunnel.exe process could then be running on it's own core. How can I accomplish this? Also, what is the fastest encryption cipher that stills has good security, over 64 bit, preferably at least 128 bit. Any help would be greatly appreciated. Thanks, -John Stunnel.conf on server: cert = my.pem verify = 3 CAfile = my.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 taskbar=no debug = 5 output = stunnel.log [rsynctnl] accept=12345 connect=873 ciphers = AES128-SHA Stunnel.conf on client: cert = my.pem taskbar = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 5 output = stunnel.log client = yes [rsynctnl] accept=12345 connect=10.9.8.7:12345 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

stunnel as ssh client and self signed certificates
by san san 07 Apr '07

07 Apr '07

Hi, I was planning to use stunnel for my rdp based product. I have several trivial doubts,but since i would be using the same in my product. I would like to know following 1.Actually i want to use stunnel in the same way as ssh i.e Client authentication only , i don't want server authentication at all in my client. So it is possible to not check any server certificate from client side. If i will be using client certificate 2.Is it possible to use self-signed certificate ? I am aware of the drawbacks of using self-signed certificates but because of some inevitable reason i have to use self-signed certificates. I am sorry for my poor knowledge. Regards

1 0

Is it possible to see the "real" IP of the client?
by Konrad Hammerer 05 Apr '07

05 Apr '07

Hi! I want to use STunnel to secure my IMAP connections to my mail server. It works fine but from now on the mail server shows 127.0.0.1 for the open imap client connections. Is there a way to get STunnel forward the real IP or is this impossible? Thanks, Konrad

2 1

How to generate my own certificate for my dynamic dns
by Konrad Hammerer 05 Apr '07

05 Apr '07

Hi! I read somewere, that it is possible to generate a certificate for STunnel. The certificate shipped with the stunnel installer is just for testing purpose, isn't it? So were can I get my own, secure certificate? Thanks, Konrad

2 1

User nobody logging in
by Dimitri Yioulos 29 Mar '07

29 Mar '07

Hi, folks. I've been using stunnel on our mail server (sendmail, spamassassin, clamav, mailscanner, mailwatch). I note the following being written to syslog, and wonder if stunnel is causing it: Mar 29 14:07:31 mail1 su(pam_unix)[29493]: session closed for user nobody Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1723 Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33540 Mar 29 14:08:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session opened for user nobody by (uid=0) Mar 29 14:08:43 mail1 su(pam_unix)[29640]: session closed for user nobody Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1724 Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33544 Mar 29 14:09:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1725 Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33546 Mar 29 14:10:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session opened for user nobody by (uid=0) Mar 29 14:10:11 mail1 su(pam_unix)[30025]: session closed for user nobody Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session opened for user nobody by (uid=0) Mar 29 14:10:33 mail1 su(pam_unix)[30075]: session closed for user nobody Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s accepted connection from 192.168.100.58:1726 Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: pop3s connected remote server from 127.0.0.1:33559 Mar 29 14:11:00 mail1 stunnel: LOG5[15993:3076422576]: Connection closed: 138 bytes sent to SSL, 42 bytes sent to socket Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session opened for user nobody by (uid=0) Mar 29 14:11:03 mail1 su(pam_unix)[30206]: session closed for user nobody Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session opened for user nobody by (uid=0) Mar 29 14:11:06 mail1 su(pam_unix)[30215]: session closed for user nobody It's the sessions opened and closed for the user nobody that has me concerned. stunnel appears to be the only process being run by the user nobody. If, in fact, this is caused by stunnel, do I keep these (and only these) session opened/closed instances from being logged? Thanks. Dimitri -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

trouble shooting Pan issue
by eph man 29 Mar '07

29 Mar '07

hi, i'm trying to trouble shoot a problem with a newsreader called pan that i might be having. here's my setup: ubuntu 6.10 kernel 2.6.17 pan 0.14.2 stunnel4 4.150 i created a snntp.conf file with only: client = yes foreground = yes debug = 7 [nntps] accept = localhost:2000 connect = inetnews.worldnet.att.net:563 then i run stunnel4 and this is the output: ephman@wintermute:~$ sudo stunnel4 /etc/stunnel/snntp.conf 2007.03.29 13:54:47 LOG7[13414:3083015856]: RAND_status claims sufficient entropy for the PRNG 2007.03.29 13:54:47 LOG6[13414:3083015856]: PRNG seeded successfully 2007.03.29 13:54:47 LOG7[13414:3083015856]: SSL context initialized for service nntps 2007.03.29 13:54:47 LOG5[13414:3083015856]: stunnel 4.15 on i486-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2007.03.29 13:54:47 LOG5[13414:3083015856]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.29 13:54:47 LOG6[13414:3083015856]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.29 13:54:47 LOG6[13414:3083015856]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.29 13:54:47 LOG5[13414:3083015856]: 500 clients allowed 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 3 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 4 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: FD 5 in non-blocking mode 2007.03.29 13:54:47 LOG7[13414:3083015856]: SO_REUSEADDR option set on accept socket 2007.03.29 13:54:47 LOG7[13414:3083015856]: nntps bound to 127.0.0.1:2000 2007.03.29 13:54:47 LOG7[13414:3083015856]: Created pid file /var/run/stunnel4.pid i then startup pan and it won't connect to the server the log file says: Thu, 29 Mar 2007 13:58:15 - Pan 0.14.2.91 Started Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/cache" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/folders/pan.sent" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - Directory "/home/ephman/.pan/messages/folders/pan.sendlater" contains 0.0 MB in 0 files Thu, 29 Mar 2007 13:58:15 - News server connection count: 0 Thu, 29 Mar 2007 13:58:19 - New connection 0x846da08 for inetnews.worldnet.att.net, port 563 Thu, 29 Mar 2007 13:59:21 - NNTP handshake failed: Error reading from socket. Thu, 29 Mar 2007 13:59:21 - Handshake failed: Error reading from socket. Thu, 29 Mar 2007 13:59:26 - New connection 0x84a5850 for inetnews.worldnet.att.net, port 563 any help or hints would be really helpful. thanks. be well, ephman

1 0

Simple Stunnel Question
by mdpeters 28 Mar '07

28 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used? Do I need to run Stunnel as a background service full time? Is there something I am missing here? Comments and advice is appreciated! ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

Stunnel support or OpenSSL in FIPS mode
by George Henson 27 Mar '07

27 Mar '07

All, Are there any current plans to include FIPS complaint mode in stunnel? I have asked some of my peers on other US Government projects and they indicated this would be a help to them as well. Looking at the users guide from the OpenSSL site (http://www.openssl.org/docs/fips/UserGuide-1.1.1.pdf) it would not appear to be a great amount of effort to make a stunnel that functions in a FIPS complaint mode. Attached I have included the patch I have created (with some help from friends). It does not do the final linking correctly as I am not very good with autmake. Please let me know what you think. Thank you George diff -u -r @stunnel-4.20/configure.ac stunnel-4.20/configure.ac --- @stunnel-4.20/configure.ac 2006-11-11 09:58:01.000000000 -0500 +++ stunnel-4.20/configure.ac 2007-03-26 18:35:09.000000000 -0400 @@ -260,6 +260,51 @@ CFLAGS="$CFLAGS -I$ssldir/include" LIBS="$LIBS -L$ssldir/lib -lssl -lcrypto" +AC_ARG_WITH(fips, + [ --with-fips Enable OpenSSL FIPS mode], + [ + if test "x$withval" != "xno" ; then + INCLUDES="=l$ssldir/include" + AC_CACHE_CHECK([for FIPS mode], ac_cv_fips, [ + AC_TRY_COMPILE( + [ #include <openssl/fips.h> ], + [ FIPS_mode_set(1); ], + [ ac_cv_fips="yes" ], + [ ac_cv_fips="no" ] + ) + ]) + fi + ] +) +if test "x$ac_cv_fips" = "xyes" ; then + CPPFLAGS="$CPPFLAGS -DOPENSSL_FIPS" + FIPS_MODE=yes + AC_SUBST(FIPS_MODE) +fi + +AC_ARG_WITH(fips, + [ --with-fips Enable OpenSSL FIPS mode], + [ + if test "x$withval" != "xno" ; then + INCLUDES="=l$ssldir/include" + AC_CACHE_CHECK([for FIPS mode], ac_cv_fips, [ + AC_TRY_COMPILE( + [ #include <openssl/fips.h> ], + [ FIPS_mode_set(1); ], + [ ac_cv_fips="yes" ], + [ ac_cv_fips="no" ] + ) + ]) + fi + ] +) +if test "x$ac_cv_fips" = "xyes" ; then + CPPFLAGS="$CPPFLAGS -DOPENSSL_FIPS" + FIPS_MODE=yes + AC_SUBST(FIPS_MODE) +fi +AM_CONDITIONAL(FIPS_MODE, test x$ac_cv_fips = xyes) + # Check for obsolete RSAref library AC_MSG_CHECKING([for obsolete RSAref library]) saved_LIBS="$LIBS" Only in stunnel-4.20: configure.ac.orig diff -u -r @stunnel-4.20/src/common.h stunnel-4.20/src/common.h --- @stunnel-4.20/src/common.h 2006-11-17 04:03:18.000000000 -0500 +++ stunnel-4.20/src/common.h 2007-03-26 18:35:03.000000000 -0400 @@ -321,6 +321,9 @@ #if SSLEAY_VERSION_NUMBER >= 0x00907000L #include <openssl/ocsp.h> #endif /* OpenSSL-0.9.7 */ +#ifdef OPENSSL_FIPS +#include <openssl/fips.h> +#endif #else /* HAVE_OPENSSL */ #include <lhash.h> #include <ssl.h> diff -u -r @stunnel-4.20/src/options.c stunnel-4.20/src/options.c --- @stunnel-4.20/src/options.c 2006-11-05 08:04:37.000000000 -0500 +++ stunnel-4.20/src/options.c 2007-03-26 18:35:03.000000000 -0400 @@ -556,7 +556,11 @@ /* ciphers */ switch(cmd) { case CMD_INIT: +#ifndef OPENSSL_FIPS section->cipher_list=SSL_DEFAULT_CIPHER_LIST; +#else + section->cipher_list="!ADH:!RC4:!RC2:!IDEA:!MD5:!NULL:TLSv1"; +#endif break; case CMD_EXEC: if(strcasecmp(opt, "ciphers")) @@ -564,7 +568,11 @@ section->cipher_list=stralloc(arg); return NULL; /* OK */ case CMD_DEFAULT: +#ifndef OPENSSL_FIPS log_raw("%-15s = %s", "ciphers", SSL_DEFAULT_CIPHER_LIST); +#else + log_raw("%-15s = %s", "ciphers", "!ADH:!RC4:!RC2:!IDEA:!MD5:!NULL:TLSv1"); +#endif break; case CMD_HELP: log_raw("%-15s = list of permitted SSL ciphers", "ciphers"); @@ -726,6 +734,31 @@ } #endif + /* fips mode */ +#ifndef USE_WIN32 + switch(cmd) { + case CMD_INIT: + options.option.fips_mode=0; + break; + case CMD_EXEC: + if(strcasecmp(opt, "fips")) + break; + if(!strcasecmp(arg, "yes")) + options.option.fips_mode = 1; + else if(!strcasecmp(arg, "no")) + options.option.fips_mode = 0; + else + return "argument should be either 'yes' or 'no'"; + return NULL; /* OK */ + case CMD_DEFAULT: + break; + case CMD_HELP: + log_raw("%-15s = yes|no FIPS mode", + "fips"); + break; + } +#endif + /* execargs */ #ifndef USE_WIN32 switch(cmd) { diff -u -r @stunnel-4.20/src/prototypes.h stunnel-4.20/src/prototypes.h --- @stunnel-4.20/src/prototypes.h 2006-11-11 08:03:05.000000000 -0500 +++ stunnel-4.20/src/prototypes.h 2007-03-26 18:35:03.000000000 -0400 @@ -142,6 +142,7 @@ unsigned int foreground:1; unsigned int syslog:1; /* log to syslog */ unsigned int rand_write:1; /* overwrite rand_file */ + unsigned int fips_mode:1; #ifdef USE_WIN32 unsigned int taskbar:1; /* enable the taskbar icon */ #endif diff -u -r @stunnel-4.20/src/stunnel.c stunnel-4.20/src/stunnel.c --- @stunnel-4.20/src/stunnel.c 2006-11-30 15:47:45.000000000 -0500 +++ stunnel-4.20/src/stunnel.c 2007-03-26 18:35:03.000000000 -0400 @@ -59,6 +59,7 @@ #ifndef USE_WIN32 int main(int argc, char* argv[]) { /* execution begins here 8-) */ +unsigned long e; main_initialize(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL); signal(SIGPIPE, SIG_IGN); /* avoid 'broken pipe' signal */ @@ -72,6 +73,21 @@ signal(SIGHUP, signal_handler); /* signal(SIGSEGV, signal_handler); */ +#ifdef OPENSSL_FIPS + if(options.option.fips_mode) { + if (!FIPS_mode_set(1)) { + log_raw("Failed to enter FIPS mode"); + ERR_load_crypto_strings(); + while((e = ERR_get_error())) { + log_raw(ERR_error_string(e,NULL)); + } + return 1; /* failure */ + } else { + log_raw("FIPS mode enabled"); + } + } +#endif + main_execute(); return 0; /* success */

1 0

using an ocsp
by Samuel Landau 26 Mar '07

26 Mar '07

Hello, I am using stunnel 4.18 and openca-ocspd 1.5.1. The OCSPd uses a delegate certificate and the setup works when tested with openssl: $ openssl ocsp -issuer /home/landau/ssl/cacert.pem -serial 3 -url http://localhost:2560 -CAfile /home/landau/ssl/cacert.pem Response verify OK 3: good This Update: Mar 23 18:27:37 2007 GMT Next Update: Mar 26 10:56:33 2007 GMT But when it comes to using stunnel, I cannot figure out how to make it use properly the OCSP. I could see that stunnel 4.19 had more options for ocsp, but I am unsure this is related to my current issue. Besides, is there a way to have stunnel fall back on local cert/crl files if the ocsp server is not available ? Regards, -- Samuel Landau ____________________________________________________________________________ This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited. E-mail messages are not necessarily secure. Archos does not accept responsibility for any changes made to this message after it was sent. 2007.03.26 12:59:05 LOG5[29250:3083020512]: stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.03.26 12:59:05 LOG5[29250:3083020512]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.26 12:59:05 LOG6[29250:3083020512]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.26 12:59:05 LOG6[29250:3083020512]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.26 12:59:05 LOG5[29250:3083020512]: 500 clients allowed 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 4 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 5 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 6 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: SO_REUSEADDR option set on accept socket 2007.03.26 12:59:05 LOG7[29250:3083020512]: server bound to 127.0.0.1:12345 2007.03.26 12:59:05 LOG7[29250:3083020512]: Created pid file /home/landau/stunnel4.pid 2007.03.26 12:59:12 LOG7[29250:3083020512]: server accepted FD=7 from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: server started 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 7 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: TCP_NODELAY option set on local socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 9 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3083020512]: Cleaning up the signal pipe 2007.03.26 12:59:12 LOG6[29250:3083020512]: Child process 29252 finished with code 0 2007.03.26 12:59:12 LOG7[29250:3082972080]: Connection from 127.0.0.1:36200 permitted by libwrap 2007.03.26 12:59:12 LOG5[29250:3082972080]: server connected from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): before/accept initialization 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 read client hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write server hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate request A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 flush data 2007.03.26 12:59:12 LOG6[29250:3082972080]: *** starting OCSP verification *** 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: waiting 10 seconds 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: OCSP server connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG6[29250:3082972080]: OCSP response received 2007.03.26 12:59:12 LOG3[29250:3082972080]: OCSP_basic_verify: 27069076: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL alert (write): fatal: certificate unknown 2007.03.26 12:59:12 LOG3[29250:3082972080]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.03.26 12:59:12 LOG5[29250:3082972080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: server finished (0 left) 2007.03.26 12:59:16 LOG3[29250:3083020512]: Received signal 2; terminating 2007.03.26 12:59:16 LOG7[29250:3083020512]: removing pid file /home/landau/stunnel4.pid cert = landau.pem key = landau.key sslVersion = SSLv3 pid =/home/landau/ssl/stunnel4.pid socket =l:TCP_NODELAY=1 socket =r:TCP_NODELAY=1 compression =zlib foreground =yes verify =3 CApath =/home/landau/ssl/ CAfile =/home/landau/ssl/cacert.pem debug =7 output =/home/landau/ssl/stunnel4.log client =no [server] accept =localhost:12345 ocsp =http://localhost:2560 pty =no exec =/bin/bash execargs =bash

1 0

[win32] stunnel/OpenSSL/Synergy howto
by P. Jansen 25 Mar '07

25 Mar '07

Hi stunnel users and especially newbies, on http://stunnel.mirt.net/docs.html you can find a link to a stunnel/OpenSSL/Synergy howto for the Win32 platform. It is a short but hopefully useful doc how to install, configure and use stunnel. Feedback and comments are welcome. - Patrick

1 0

Solaris 10 and MySQL questions
by mdpeters 25 Mar '07

25 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used. Do I need to run Stunnel as a background service full time? Is there something I am missing here? ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

How to surf the web over proxy?
by P. Jansen 25 Mar '07

25 Mar '07

Hi, I know there is a way to do the following with SSH+PuTTY, with stunnel too? Do I need further software? Windows office computer --> (HTTP) --> Corporate firewall/proxy --> (HTTP) --> Home computer --> WWW Regards, Patrick

1 0

Stunnel 4.20 with TCP Wrappers 7.6 problem in configure.ac
by lists＠d-ra.ath.cx 18 Mar '07

18 Mar '07

Hi, the following patch makes stunnel 4.20 to operate with TCP wrappers 7.6. I had not tried other versions of stunnel nor TCP wrappers. The problem is the missing libnsl, so TCP wrappers will never be activated in ./configure Regards Dieter --- configure.ac.orig 2007-03-17 12:57:32.000000000 +0100 +++ configure.ac 2007-03-17 12:55:19.000000000 +0100 @@ -310,7 +310,7 @@ AC_MSG_RESULT([no (autodetecting)]) AC_MSG_CHECKING([for hosts_access in -lwrap]) saved_LIBS="$LIBS" - LIBS="$saved_LIBS -lwrap" + LIBS="$saved_LIBS -lwrap -lnsl" AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[int hosts_access(); int allow_severity, deny_severity;]],

2 9

Getting a "Peer suddenly disconnected" error
by David Goodwin 09 Mar '07

09 Mar '07

Hey all, I'm getting this in the /var/adm/messages log on the server side when attempting to connect from the client: Mar 8 22:23:33 SERVERNAME stunnel: [ID 821868 daemon.error] LOG3[27429:4]: SSL_connect: Peer suddenly disconnected I have the server configured as follows: cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/stunnel.pem [sunrpc] accept=112 connect=127.0.0.1:111 TIMEOUTclose=10 This is started just by running stunnel with the config file and then starting rpcbind normally. The client is configured as follows: # cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/imnxnsm0.pem [sunrpc] accept=111 connect=SERVERNAME:112 The error shows up when I attempt to run "rpcinfo -p 127.0.0.1". Snoop is showing the following (adjusted to remove hostnames/ips): CLIENT -> SERVER TCP D=112 S=63986 Syn Seq=867918817 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> SERVER -> CLIENT TCP D=63986 S=112 Syn Ack=867918818 Seq=209756753 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=0 Win=24820 CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=88 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Ack=867918906 Seq=209756754 Len=0 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Rst Seq=209756754 Len=0 Win=24820 I'm pretty new to stunnel, and am having a heck of a time getting this to work. This configuration is the closest I've been to success so far. Is there a better way for me to wrap rpcbind perhaps? Any help with this will be appreciated. Thanks, Civil

2 2

DLLs for OpenSSL 0.9.8e
by Michal Trojnara 09 Mar '07

09 Mar '07

Dear Users, I've built the DLLs for OpenSSL 0.9.8e. They're available for download from: ftp://stunnel.mirt.net/openssl/binary-0.9.8e-zdll/ Best regards, Mike

1 0

problem accesing a https site as a Windows version client
by Gustavo 09 Mar '07

09 Mar '07

I'm running stunnel version 4.2 on Windows XP I can access a lot of websites, example https://servicios.afip.gov.ar/tramites_con_clave_fiscal/misAportes/images/t… but CAN'T access https://apwebserver.rentasgcba.gov.ar/ablpatib_ssl/images/Actitud_BsAs_negr… apparently a response never arrives to my PC my conf file is cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes ; Service-level configuration [https1] client = yes accept = 6001 connect = servicios.afip.gov.ar:443 TIMEOUTclose = 0 [https] client = yes accept = 6002 connect = apwebserver.rentasgcba.gov.ar:443 TIMEOUTclose = 5 ; vim:ft=dosini

2 1

Download speed affected with stunnel help needed please.
by tom hammond 07 Mar '07

07 Mar '07

Using HFS 2.1d http://www.rejetto.com and Stunnel 4.20 on single WinXP machine. The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = # connect = # TIMOUTclose = 0 I dont'understand 3-7 as given here: http://www.stunnel.org/support/ only used OpenSSL to make CERT Win32 OpenSSL v0.9.8e Light *************************************** Description: HFS is a webserver that can only utilize HTTP, therefore I turned to Stunnel to implement https. When using HTTPs: for UPLOADING I get full speed. When using HTTPs: for DOWNLoADING the speed in cut drastically, 20x slower. The odd thing is, multiple downloads can go at once eg: 20 connections @80kb/second However no single connection will get over 80 or 100kb/second I searched the net and couldn't find a solution, but continuously came across mention of "loopback" problems with stunnel and http servers (old posts) or saying stuff about Microsoft winsock, found a few mentions of VNC server having an option to "enable loopback connections" Another thing I saw but closed (oops) was mention of disabling an HTTP server in order to avoid loopback problems with HTTPS serving.(HFS has no option because it is designed to serve ONLY HTTP) I have tons of hope for an easy solution for the following reasons: #1, uploading works perfect #2 just downloaded demo of Easy File Sharing Web Server(not free like HFS) and the download speed works through HTTPS. I have no clue as to how to fix this, saw one entry in the stunnel config at ssl.org: socket = a:SO_BINDTODEVICE=lo I DID attempt to enter this line into the config under my 2 original entries, but then stunnel would not start. Thank you --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

1 0

init_ssl: s_poll_wait timeout
by William Biagi 06 Mar '07

06 Mar '07

I am using a Eudora client configured to use STARTLS to send mail through stunnel to a sendmail server. The stunnel config is as follows: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = DONT_INSERT_EMPTY_FRAGMENTS delay = yes TIMEOUTconnect = 300 TIMEOUTbusy = 300 setuid = smtpauth setgid = smtpauth debug = 7 client = no foreground = yes pid = [smtps] accept = 465 connect = localhost:25 protocol=smtp When I send mail the connection is established with port 465 on stunnel but it fails to negotiate the ssl session. THis is the log: 2007.03.06 15:45:08 LOG7[17753:1024]: Snagged 64 random bytes from /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: Wrote 1024 new random bytes to /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: RAND_status claims sufficient entropy for the PRNG 2007.03.06 15:45:08 LOG7[17753:1024]: PRNG seeded successfully 2007.03.06 15:45:08 LOG7[17753:1024]: Configuration SSL options: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: SSL options set: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate loaded 2007.03.06 15:45:08 LOG7[17753:1024]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Private key loaded 2007.03.06 15:45:08 LOG7[17753:1024]: SSL context initialized for service smtps 2007.03.06 15:45:08 LOG5[17753:1024]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.7l 28 Sep 2006 2007.03.06 15:45:08 LOG5[17753:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 2007.03.06 15:45:08 LOG6[17753:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.06 15:45:08 LOG6[17753:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.06 15:45:08 LOG5[17753:1024]: 500 clients allowed 2007.03.06 15:45:08 LOG7[17753:1024]: FD 3 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 4 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 5 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: SO_REUSEADDR option set on accept socket 2007.03.06 15:45:08 LOG7[17753:1024]: smtps bound to 0.0.0.0:465 2007.03.06 15:45:08 LOG7[17753:1024]: No pid file being created 2007.03.06 15:45:18 LOG7[17753:1024]: smtps accepted FD=6 from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: smtps started 2007.03.06 15:45:18 LOG7[17755:1026]: FD 6 in non-blocking mode 2007.03.06 15:45:18 LOG7[17755:1026]: TCP_NODELAY option set on local socket 2007.03.06 15:45:18 LOG5[17755:1026]: smtps accepted connection from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: SSL state (accept): before/accept initialization 2007.03.06 15:45:20 LOG6[17755:1026]: init_ssl: s_poll_wait timeout 2007.03.06 15:45:20 LOG5[17755:1026]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.06 15:45:20 LOG7[17755:1026]: smtps finished (0 left) 2007.03.06 15:47:00 LOG3[17753:1024]: Received signal 2; terminating Can anyone tell me what I am doing wrong? BB

1 0

High CPU system usage on Solaris
by armando.salvatori＠accenture.com 05 Mar '07

05 Mar '07

We use stunnel process to encrypt Oracle connections from a set of 4-6 application server. On the DB server, 20 cpus Solaris machine running Oracle, we have more then 400 LWPS for stunnel and the relative 400 oracle connections. We experience a huge amount of cpu usage (system component), about 40%, after stunnel setup (stunnel 4.15 version) Is it usual? Do you have experience on similar situation? Do you have any suggestions to improve cpu usage or to address performance issue/tuning? Thank you very much AS This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

make compile error options.c parse_ocsp_url
by William Biagi 03 Mar '07

03 Mar '07

./configure was successful but the make gave me the following: Making all in src make[1]: Entering directory `/home/bbiagi/stunnel-4.20/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.20\" -DPACKAGE_STRING=\"stunnel\ 4.20\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.20\" -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `parse_ocsp_url': options.c:1762: warning: implicit declaration of function `OCSP_parse_url' options.c:1767: structure has no member named `ocsp_addr' options.c:1769: structure has no member named `ocsp_path' options.c: In function `parse_ocsp_flag': options.c:1786: `OCSP_NOCERTS' undeclared (first use in this function) options.c:1786: (Each undeclared identifier is reported only once options.c:1786: for each function it appears in.) options.c:1787: `OCSP_NOINTERN' undeclared (first use in this function) options.c:1788: `OCSP_NOSIGS' undeclared (first use in this function) options.c:1789: `OCSP_NOCHAIN' undeclared (first use in this function) options.c:1790: `OCSP_NOVERIFY' undeclared (first use in this function) options.c:1791: `OCSP_NOEXPLICIT' undeclared (first use in this function) options.c:1792: `OCSP_NOCASIGN' undeclared (first use in this function) options.c:1793: `OCSP_NODELEGATED' undeclared (first use in this function) options.c:1794: `OCSP_NOCHECKS' undeclared (first use in this function) options.c:1795: `OCSP_TRUSTOTHER' undeclared (first use in this function) options.c:1796: `OCSP_RESPID_KEY' undeclared (first use in this function) options.c:1797: `OCSP_NOTIME' undeclared (first use in this function) options.c: At top level: options.c:1758: warning: `parse_ocsp_url' defined but not used options.c:1781: warning: `parse_ocsp_flag' defined but not used make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/home/bbiagi/stunnel-4.20/src' make: *** [all-recursive] Error 1 I am trying to install on a red hat 7.3 with openssl-0.9.6b-18

2 1