- stunnel-users - stunnel.org

setting up HTTPS service?
by joe＠strout.net 13 Nov '06

13 Nov '06

Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe

3 3

resending FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

stunnel on Windows with pkcs11
by Neil M. 10 Nov '06

10 Nov '06

Can anyone provide more details in how to get this setup working? I've setup stunnel in client mode just fine for normal SSL operations, but now I need to load a client certificate from a token. I've looked at the example in the documentation and changed the paths accordingly, but that doesn't seem to work, stunnel errors out complaining about a DSO. Neil

1 0

FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

2 1

stunnel 4.16 wrapped around an ldap server causing very slow binds
by Mark McCoy 05 Nov '06

05 Nov '06

Hey all, I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel. I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results. An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes. Any ideas on what to look for? ------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -------------- -- Mark McCoy -- Professional Unix geek Here in America we are descended in blood and in spirit from revolutionists and rebels - men and women who dared to dissent from accepted doctrine. As their heirs, may we never confuse honest dissent with disloyal subversion. -- Dwight D. Eisenhower

2 1

newbie sendmail + smtp question
by Fred nietzsche 03 Nov '06

03 Nov '06

My ISP requires all my mail to go to mail.myISP.net via SSL to port 465. I have sendmail compiled with STARTTLS, configured authinfo and I've set up sendmail's smarthost to send everything to mail.myISP.net I run stunnel like this. stunnel /etc/stunnel/stunnel.conf -c -d 25 -r mail.myISP.net:465 There are no errors in the log. I can see stunnel listening on 25 with netstat. When I try to send mail I get: bash-3.00# sendmail -v sc00b123(a)yahoo.com <test sc00b123(a)yahoo.com... Connecting to [127.0.0.1] via relay... Which just hangs for ever. My stunnel.conf looks like: cert = /etc/stunnel/mail.pem chroot = /var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [smtp] accept = 25 connect = 465 Thanks for any help, hints, etc.. --------------------------------- Low, Low, Low Rates! Check out Yahoo! Messenger's cheap PC-to-Phone call rates.

1 0

stunnel[2840]: Error binding pop3s to 0.0.0.0:995
by fxper 02 Nov '06

02 Nov '06

I'm trying to use stunnel on a redhat machine to securely check email, via xinetd via pop3d. My /etc/xinetd.d/pop3s looks like this: service pop3s { socket_type = stream wait = no user = root server = /usr/sbin/stunnel log_on_success += USERID log_on_failure += USERID disable = no } And netstat just shows xinetd on 995: netstat -apn|grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 2797/xinetd When I try to check mail with my client hitting port 995, I get this in /var/log/secure using debug level 7: Nov 1 16:17:24 myhostname xinetd[2797]: START: pop3s pid=2840 from=x.x.x.x Nov 1 16:17:54 myhostname stunnel[2840]: stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Nov 1 16:17:54 myhostname stunnel[2840]: Snagged 64 random bytes from /dev/urandom Nov 1 16:17:54 myhostname stunnel[2840]: RAND_status claims sufficient entropy for the PRNG Nov 1 16:17:54 myhostname stunnel[2840]: PRNG seeded successfully Nov 1 16:17:54 myhostname stunnel[2840]: Certificate: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: Key file: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Nov 1 16:17:54 myhostname stunnel[2840]: FD 4 in non-blocking mode Nov 1 16:17:54 myhostname stunnel[2840]: SO_REUSEADDR option set on accept socket Nov 1 16:17:54 myhostname stunnel[2840]: Error binding pop3s to 0.0.0.0:995 Nov 1 16:17:54 myhostname stunnel[2840]: bind: Address already in use (98) Any suggestions? Thanks! --------------------------------- Want to start your own business? Learn how on Yahoo! Small Business.

1 0

How to disable SSLv2
by Tommi Nieminen 30 Oct '06

30 Oct '06

I'm using Stunnel 4.18. I would like to disable SSLv2, but allow SSLv3 and TLSv1. Is this currently possible in Stunnel? I've tried two things so far: first I tried to use the option options = SSL_OP_NO_SSLv2 (from "man SSL_CTX_set_options") It didn't work. This is what I got: 2006.10.27 18:32:48 LOG7[6358:3082897088]: Snagged 64 random bytes from /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: Wrote 1024 new random bytes to /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: RAND_status claims sufficient entropy for the PRNG 2006.10.27 18:32:48 LOG7[6358:3082897088]: PRNG seeded successfully file /etc/stunnel/stunnel.conf line 18: Illegal SSL option Nothing gets logged, the above is the response to the startup command. The other thing I tried, though I really didn't expect it to work, was replacing the "options" option with sslVersion = SSLv3 TLSv1 This option seems to accept only one version at a time, or alternatively all of them with "all" on the right hand side, so this failed, stunnel didn't start. Any suggestions? The only thing I can think of is that the SSL option SSL_OP_NO_SSLv2 is something that should have been when configuring the OpenSSL installation, and since I have a readily wrapped package, it has not been included there. In that case I could install OpenSSL from the scratch. But before I try that, I thought I would ask if somebody were already familiar with the problem. Tommi Nieminen --------------------------------------------------- Here is the stunnel config file I was using: CAfile = /etc/stunnel/root-cert.pem cert = /etc/stunnel/device-cert.pem key = /etc/stunnel/device-key.pem output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 verify = 1 options = SSL_OP_NO_SSLv2 ;sslVersion = SSLv3 TLSv1

2 2

stunnel patch for extra logging
by Steven Van Acker 29 Oct '06

29 Oct '06

Hi, we use stunnel in server-mode where an SSL enabled client can connect to our stunnel, and then stunnel connects to a non-SSL backend server. The backend server logs incoming connections from stunnel (source IP and port), but stunnel doesn't log the same information. This makes it difficult to match logs between stunnel and the backend. This patch solves exactly this problem. I rewrote the patch so that it can be cleanly applied to any future (and past) version of stunnel. >From the website: "How do I get a patch included into the release versions of Stunnel? Only patches released into the public domain stand a chance of getting into the actual Stunnel source. This means revised BSD patches are likely acceptable. Original BSD and GNU patches are not for example." Since I would like very much that this patch makes it into the next release, I'll release it into the public domain or any other license that makes this possible. kind regards, Steven -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Re: [stunnel-users] Fork Error
by Michal Trojnara 29 Oct '06

29 Oct '06

On Friday 27 October 2006 22:39, John O'Fallon wrote: > I do believe, though, that the problem is due to a change in Stunnel > between version 4.15 and 4.17, since the crash occurs when running > 4.17, but reverting to 4.15 on exactly the same system clears it up. > I have seen this on at least 2 different Mac servers. Please make some tests for me: 1. Try: ./configure --disable-libwrap make clean make make install 2. Check if there are some zombies produced by stunnel. 3. Include your configuration file and the output of "stunnel -version" with your next email. Best regards, Mike

1 0

SMTP & TLS
by Eric B. 27 Oct '06

27 Oct '06

Hi, I've been looking over using stunnel to secure SMTP connections, but am a little confused about how the protocol works. From what I've read, the STARTTLS command is used to allow a client/server to upgrade a connection from plaintext to SSL secured. Further to that, from what I understand, the concept is to allow/use a single port to initiate all connections - ex: port 25. >From what I can tell from stunnel however, is that once stunnel issues the STARTTLS command, if the client doesn't respond in kind, then the connection is terminated. I've tried reading the RFC, but can't seem to find what happens in the case where the client rejects or does not respond to the STARTTLS command. Logicially, I would expect the SMTP connection to continue normally in plaintext. Apparently, this is not how stunnel works. Can someone please help fill in the blanks for me please? What is supposed to happen if the client refuses the STARTTLS request from the server? If the connection is supposed to die, why bother with the STARTTLS request at all, and not just impose the SSL encrypted tunnel from the very beginning (as per the old SSMTP specs)? Thanks, Eric

1 0

Fork Error
by John O'Fallon 27 Oct '06

27 Oct '06

Since upgrading to Stunnel 4.17, I occasionally get the following error: 2006.10.18 23:08:45 LOG3[7007:25232896]: fork: Resource temporarily unavailable (35) 2006.10.18 23:08:45 LOG5[7007:25232896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The problem doesn't occur right away, but after some number of hits on the server. Reverting to Stunnel 4.15 corrects the problem. This is an OS X 10.4 Mac. I haven't confirmed the problem with 4.18, because the release notes indicate mainly changes relevant to Win32. Has any one else seen the problem? Michal, any thoughts? TIA, John

2 1

Stunnel hangs on big flows of data
by Dario Mariani 27 Oct '06

27 Oct '06

Hi... I'm deploying stunnel on some servers. I did some tests, and i never had problems. For example, i tried 5k parallel connections, and i didn't have any problem. But, i have problems when a small number of connections wants to transfer big chunks of information; the connection hangs. This is a snippet of logs: Server side: 2006.10.20 16:00:58 LOG7[20302:1]: oracle11521 accepted FD=226 from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 started 2006.10.20 16:00:58 LOG7[20302:200]: FD 226 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on local socket 2006.10.20 16:00:58 LOG5[20302:200]: oracle11521 connected from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): before/ accept initialization 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read client hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write server hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write finished A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 flush data 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read finished A 2006.10.20 16:00:58 LOG7[20302:200]: 3 items in the session cache 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects (SSL_connect ()) 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 client renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 199 server connects (SSL_accept()) 2006.10.20 16:00:58 LOG7[20302:200]: 194 server connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 server renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 173 session cache hits 2006.10.20 16:00:58 LOG7[20302:200]: 0 session cache misses 2006.10.20 16:00:58 LOG7[20302:200]: 18 session cache timeouts 2006.10.20 16:00:58 LOG6[20302:200]: SSL accepted: previous session reused 2006.10.20 16:00:58 LOG7[20302:200]: FD 227 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 connecting 192.168.22.13:1521 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: waiting 10 seconds 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: connected 2006.10.20 16:00:58 LOG7[20302:200]: Remote FD=227 initialized 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on remote socket 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying client side: 2006.10.20 16:16:01 LOG6[12415:91]: SSL connected: new session negotiated 2006.10.20 16:16:01 LOG6[12415:91]: Negotiated ciphers: DES-CBC3- SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2006.10.20 16:16:01 LOG7[12415:91]: Socket closed on read 2006.10.20 16:16:01 LOG7[12415:91]: SSL write shutdown 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (write): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL_shutdown retrying 2006.10.20 16:16:01 LOG7[12415:91]: SSL doesn't need to read or write 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (read): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL closed on SSL_read 2006.10.20 16:16:01 LOG7[12415:91]: Socket write shutdown 2006.10.20 16:16:01 LOG5[12415:91]: Connection closed: 3663 bytes sent to SSL, 5239 bytes sent to socket 2006.10.20 16:16:01 LOG7[12415:91]: oracle11521 finished (3 left) The timings are shifted, i don't know if the delta of time is related to a misconfiguration of clock on the machines, or are snippets taken from different events... i don't have direct access to the machines. I tried to make a test (client and server on the same machine) client: nc localhost 10001 >>/dev/null stunnel accept on 10001 and connect to localhost:11521 on the server side: stunnel accept on 11521 and connect on 1521 cat 230megsfile | nc -l -p 1521 & 2>&1 >>/dev/null so, when the nc on client side connects, the server starts the cat. It did complete correctly within a pair of minutes on an ibook 64 1.33 1g ram, but with LOADS of want_read and want_write errors on both sides of stunnel. The server and client are working on "big iron", i mean some superdome hardware with 30-40 cpu on both sides, and with an estimated traffic of 10gig/day And, important... the version of the stunnel instances is 4.15 Can you help me? Bye, dario.

2 4

Fwd: [stunnel-users] Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

I forgot to send this to the entire group. My server program was listening on the wrong port. :-) Thanks, - Jeremiah ---------- Forwarded message ---------- From: Jeremiah Martell <inlovewithgod(a)gmail.com> Date: Oct 25, 2006 8:59 AM Subject: Re: [stunnel-users] Stunnel client not sending data To: Carter Browne <cbrowne(a)cbcs-usa.com> HA! Such a simple thing, but yes, that was the problem. I had the wrong port. :-) Thanks, - Jeremiah On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > Jeremiah, > > I set the debug level on a stunnel configuration to 7 to understand better where you are failing. You have established > good connection to stunnel, but stunnel cannot get to 127.0.0.1:10000. So is your application listening on > 127.0.0.1:10000? Have you tried running netstat -an to establish that there is a process listening to the port? > > Carter > > Jeremiah Martell wrote: > > Carter, > > > > You're right. That was a typo error on my part. My config says 1.2.3.70. > > > > Anything other ideas? > > > > Thanks, > > - Jeremiah > > > > On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > >> On the server side, I think you should be receiving on 1.2.3.70 (since > >> that is where you are sending the data). > >> > >> Carter > >> > >> Jeremiah Martell wrote: > >> > Hello, > >> > > >> > I have a program that opens up a connection to port 10000 of a server > >> > and sends it some data. It works normally. I'm trying to "stunnel" > >> > both ends. > >> > > >> > In my program I create a socket, connect to local port 7033, send my > >> > data, and close the socket. I verified that every function call > >> > returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, > >> > connect, and send). > >> > > >> >> From what the logs show below, it seems that server stunnel gets the > >> > connection from the client stunnel, they successfully negotiate the > >> > SSL stuff, then the client stunnel waits for any data to proxy to the > >> > server stunnel. The server stunnel is waiting too, and after 10 > >> > seconds of no data, it closes the socket. > >> > > >> > For some reason the client stunnel is not getting my data and > >> > therefore doesn't forward anything over to the server stunnel. I'm not > >> > sure why this is happening, because my program works normally and I've > >> > verified that everything returned success. > >> > > >> > Any ideas? > >> > > >> > - Jeremiah > >> > > >> > ----------------------------- > >> > > >> > ON CLIENT (1.2.3.60) > >> > > >> > Linux > >> > stunnel 4.16 > >> > OpenSSL 0.9.7c > >> > > >> > stunnel.conf is... > >> > pid = > >> > client = yes > >> > > >> > [7033] > >> > accept = 127.0.0.1:7033 > >> > connect = 1.2.3.70:7033 > >> > > >> > ----------------------------- > >> > > >> > ON SERVER (1.2.3.70) > >> > > >> > Windows > >> > stunnel 4.16 windows binary installer (Aug 31 2006) > >> > > >> > stunnel.conf is... > >> > > >> > cert = stunnel.pem > >> > socket = l:TCP_NODELAY=1 > >> > socket = r:TCP_NODELAY=1 > >> > debug = 7 > >> > > >> > [7033] > >> > accept = 1.2.3.60:7033 > >> > connect = 127.0.0.1:10000 > >> > > >> > ----------------------------- > >> > > >> > On client I see this debug... > >> > > >> > Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from > >> > 127.0.0.1:10251 > >> > Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by > >> > peer (104) > >> > Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes > >> > sent to SSL, 0 bytes send to socket > >> > > >> > ----------------------------- > >> > > >> > On server I see this debug... > >> > > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from > >> > 1.2.3.60:10252 > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread > >> > 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local > >> socket > >> > 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept > >> > initialization > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > certificate A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server done A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client key exchange A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > change cipher spec A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects > >> (SSL_connect()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects > >> (SSL_accept()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session > >> negotiated > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA > >> > SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds > >> > 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout > >> > 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to > >> > SSL, 0 bytes sent to socket > >> > 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left) > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)mirt.net > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > >> > >> > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Trying to redirect with stunnel - seems to hang
by Len DiMaggio 26 Oct '06

26 Oct '06

'Evening everyone, I'm wondering if anyone has already seen a problem like this. Background - I'm trying to use stunnel to act as an SSL server and redirect connections so that I can use the JMeter script recorder to build automated tests for an app's web GUI. (The recorder does not support SSL.) The software versions are: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 I'm able to set up the redirection, and everything in the stunnel log looks OK - and, this is just making the connection manually - without JMeter - but trying to access the target app just hangs in the browser with a "connecting to..." status message. Here's the stunnel config file that I'm using - the log is attached. client=yes output=/tmp/stunnel.log debug=debug [8084] accept=hostname:8079 connect=hostname:8084 Interestingly - when I kill the stunnel process, the browser displays (most of) the target app's top level page. Thanks in advance, Len DiMaggio ldimaggi(a)redhat.com The stunnel log sez: 2006.10.24 04:58:33 LOG5[5869:3086362304]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2006.10.24 04:58:33 LOG5[5869:3086362304]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2006.10.24 04:58:33 LOG6[5869:3086362304]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.10.24 04:58:33 LOG6[5869:3086362304]: poll() used - no FD_SETSIZE limit for file descriptors 2006.10.24 04:58:33 LOG5[5869:3086362304]: 500 clients allowed 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 4 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 5 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 6 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: SO_REUSEADDR option set on accept socket 2006.10.24 04:58:33 LOG7[5869:3086362304]: 8084 bound to 10.15.49.274:8079 2006.10.24 04:58:33 LOG7[5870:3086362304]: Created pid file /var/run/stunnel.pid 2006.10.24 04:58:52 LOG7[5870:3086362304]: 8084 accepted FD=7 from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 started 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 7 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 9 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086362304]: Cleaning up the signal pipe 2006.10.24 04:58:52 LOG6[5870:3086362304]: Child process 5874 finished with code 0 2006.10.24 04:58:52 LOG7[5870:3086359440]: Connection from 172.16.83.99:58417 permitted by libwrap 2006.10.24 04:58:52 LOG5[5870:3086359440]: 8084 connected from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 connecting 10.15.49.274:8084 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: waiting 10 seconds 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: connected 2006.10.24 04:58:52 LOG7[5870:3086359440]: Remote FD=8 initialized 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): before/connect initialization 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server certificate A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server done A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client key exchange A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write change cipher spec A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 flush data 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 items in the session cache 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects (SSL_connect()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 client renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects (SSL_accept()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache hits 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache misses 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache timeouts 2006.10.24 04:58:52 LOG6[5870:3086359440]: SSL connected: new session negotiated 2006.10.24 04:58:52 LOG6[5870:3086359440]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 -- Len DiMaggio (ldimaggi(a)redhat.com) Red Hat USA 10 Technology Park Drive Westford, MA 01886 tel: 978.392.3179 cell: 617.872.3673 http://www.redhat.com

3 2

status of www.stunnel.org
by Steven Van Acker 26 Oct '06

26 Oct '06

Hi, I noticed how the website http://www.stunnel.org is out of sync with the latest releases of stunnel. Are there plans to update this site ? And if not, would it be possible to redirect its visitors to http://stunnel.mirt.net/ automatically ? kind regards, -- Steven Van Acker -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

Hello, I have a program that opens up a connection to port 10000 of a server and sends it some data. It works normally. I'm trying to "stunnel" both ends. In my program I create a socket, connect to local port 7033, send my data, and close the socket. I verified that every function call returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, connect, and send). >From what the logs show below, it seems that server stunnel gets the connection from the client stunnel, they successfully negotiate the SSL stuff, then the client stunnel waits for any data to proxy to the server stunnel. The server stunnel is waiting too, and after 10 seconds of no data, it closes the socket. For some reason the client stunnel is not getting my data and therefore doesn't forward anything over to the server stunnel. I'm not sure why this is happening, because my program works normally and I've verified that everything returned success. Any ideas? - Jeremiah ----------------------------- ON CLIENT (1.2.3.60) Linux stunnel 4.16 OpenSSL 0.9.7c stunnel.conf is... pid = client = yes [7033] accept = 127.0.0.1:7033 connect = 1.2.3.70:7033 ----------------------------- ON SERVER (1.2.3.70) Windows stunnel 4.16 windows binary installer (Aug 31 2006) stunnel.conf is... cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 [7033] accept = 1.2.3.60:7033 connect = 127.0.0.1:10000 ----------------------------- On client I see this debug... Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from 127.0.0.1:10251 Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by peer (104) Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes sent to SSL, 0 bytes send to socket ----------------------------- On server I see this debug... 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from 1.2.3.60:10252 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local socket 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept initialization 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write certificate A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server done A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client key exchange A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects (SSL_connect()) 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects (SSL_accept()) 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session negotiated 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left)

3 4

[OT] Questions about OpenSSL
by Gonzalo Diethelm 25 Oct '06

25 Oct '06

Hello everyone, I have a slightly off-topic question but one I think stunnel's developers are in a good position to assist me with. I need to implement what amounts to an embedded web server for a process that will be deployed on a "hostile" server (Win32), meaning that I don't want the people in that server to mess around with either the process or the network traffic to/from the process. The goal is to deploy a binary and a set of DLLs to the hostile server (no configuration files). To this effect, I have found a couple of usable HTTP server libraries, and I have implemented the functionality I need over clean HTTP. Now, I would like to use SSL to encrypt the data coming and going to my process; alas, I have not found any open source HTTP library that also supports HTTPS. Therefore, I have come to the conclusion that I will have to integrate OpenSSL into one of the HTTP libraries myself. The first question is: how difficult is it to integrate OpenSSL in "server mode" into an application? I tried taking a peek at Apache's mod_ssl, but being unfamiliar with Apache's internals, I was completely lost. Then it occurred to me that stunnel must do something similar to what I need, and indeed I could follow the code in stunnel to a point; before going any further, I wanted to first hear comments, opinions and hints from the developers. It also occurred to me that I could do what I need if stunnel offered some kind of "in process" handling of requests: instead of forwarding to a certain host:port the requests it gets, maybe stunnel itself could be configured to process the requests somehow, generate the responses and send them back; for instance, what I need to do is basically query a MySQL DB and send some records back. I am pretty sure this is not supported in stunnel today, but if it is something that anyone (besides me) sees as useful, I could volunteer to do at least part of the development. Alternatively, please feel free to educate me on why this is a moronic idea... In any case, thanks for a great product and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Connection problems and TCP frame checksum errors
by Tommi Nieminen 23 Oct '06

23 Oct '06

I have the following kind of test environment: SSL clients call a public ip address from which the calls are forwarded to a linux server with Stunnel. The linux server is in a private network. Stunnel decrypts the data and sends it forward. I have been testing this with a browser, monitoring the traffic on the server to see that Stunnel forwards the calls. Some strange things happen there that I can't explain. First of all: sometimes the calls go through the server as expected, sometimes the server doesn't respond in any way to the client. If I have two terminal windows open, one with tcpdump and another with tail -f stunnel.log - nothing comes into the log in spite of the incoming connections attempts. Then on other occasions when the calls come to the server, it forwards them beautifully to the address and port set in the configuration file. Does anyone have any clue, what this could be due to? I haven't been able to explain why it sometimes works and sometimes doesn't. Another thing that bothers me is, that sometimes there are TCP frames with incorrect checksum. I've monitored with Ethereal and tcpdump. Both show incorrect frames, and they are always from the stunnel-end of the connection. What could be the cause of those broken frames? Tommi Nieminen -------------------------------------------------------- My stunnel.conf looks like this: (any constructive criticism would be welcome :-)) CAfile = /home/tommi/cert/7/demoCA/cacert.pem cert = /home/tommi/cert/7/newcert.pem key = /home/tommi/cert/7/newkey.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 -------------------------------------------------------- A succesful connection from stunnel.log: 2006.10.09 18:01:43 LOG7[11889:3083744960]: https accepted FD=7 from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: https started 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 7 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on local socket 2006.10.09 18:01:43 LOG5[11889:3083742128]: https connected from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): before/accept initialization 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write certificate A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server done A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client key exchange A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: 2 items in the session cache 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects (SSL_connect()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 8 server connects (SSL_accept()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 7 server connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 server renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 4 session cache hits 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache misses 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache timeouts 2006.10.09 18:01:43 LOG6[11889:3083742128]: SSL accepted: new session negotiated 2006.10.09 18:01:43 LOG6[11889:3083742128]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 8 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: https connecting 192.168.10.17:5010 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: waiting 10 seconds 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: connected 2006.10.09 18:01:43 LOG7[11889:3083742128]: Remote FD=8 initialized 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on remote socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: Socket closed on read 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL write shutdown 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL alert (write): warning: close notify 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL_shutdown retrying 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL doesn't need to read or write 2006.10.09 18:02:45 LOG6[11889:3083742128]: s_poll_wait timeout: connection close 2006.10.09 18:02:45 LOG5[11889:3083742128]: Connection closed: 0 bytes sent to SSL, 405 bytes sent to socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: https finished (0 left) (and the failed connections leave also no mark in the log, but tcpdump sees the attempts on the server) -------------------------------------------------------- A sample of tcpdump's output with incorrect checksum: 18:02:45.150656 IP (tos 0x0, ttl 64, id 11218, offset 0, flags [DF], proto: TCP (6), length: 77) 192.168.20.18.https > 131.177.254.92.2689: P, cksum 0x5708 (incorrect (-> 0xf1bf), 1035:1072(37) ack 756 win 7504

2 6

Thank you very much for all your donations
by Michal Trojnara 21 Oct '06

21 Oct '06

Dear Users, I want you to know how much grateful I am for all your donations. Thank you very much. Some day stunnel may be full-time job. 8-) Even now sponsored features make a substantial addition to my budget. BTW: I have updated currency to USD. I hope it's more convenient. http://stunnel.mirt.net/ Best regards, Mike

1 0

error 1703, service already exists.
by Joop Blokker 20 Oct '06

20 Oct '06

Hello, I'm using sTunnel v4.18 under Windows XP as a client. I start the serv= ice with sTunnel -install -quiet If, for any reason, the same command is given again then the error mes= sage "Create service; error 1703; the specified service already exists= " pops up. In that case the -quiet parameter does not work. I do not w= ant to see that error message; if the service is running then it's oka= y. Q:. How can I suppress that error message? If that is not an option, h= ow can I detect that the sTunnel service is installed already? I'm programming in PowerBASIC - I know how to detect sTunnel once it h= as started with -start -quiet Thanks in advance for any idea! Joop. +++ Too far East is West. - Proverb (English) +++

2 1

stunnel client without any configuration
by Thomas Stegbauer 18 Oct '06

18 Oct '06

hi ml, i searched the list about an idea, but didn't find the complete answer, so i would ask: i am thinking about a https website (with logon), where you can download a completly preconfigured package (java-applet?) which checks HTTP_PROXY on unix and the msie registry settings on windows and connect a local port to a remote running stunnel, listening on port 443 (the stunnel ist running on a different ip). currently there are imho two points, which need solved: 1.) there is no proxy support, without a patch 2.) it is currently not possible to download a preconfigured package are there some thoughts? greetings thomas -- # Thomas Stegbauer # https://keyserver1.pgp.com/vkd/DownloadKey.event?keyid=0x9A3F1866FC68E91D # Key fingerprint = 5A2D FEDC 8A50 F1BB 25FB 967B 9A3F 1866 FC68 E91D

2 1

Infinite client timeout
by Dario Mariani 18 Oct '06

18 Oct '06

Hi all, i'm a new user :) I'm deploying stunnel into a big enterprise, so i have met a lot of interesting details about Stunnel :) I have a little problem now: a Stunnel channel connecting BEA Weblogic -> Oracle listener. BEA has the BIG problem of _completely locking_ when the connection goes down: when the connection comes up again, bea doesn't work. This is not an issue, because there's a keepalive feature that can be activated in BEA. In a case, we _cannot_ activate the keepalive, so we must try to keep the BEA -> stunnel client conection open indefinitely. I think this must apply to the other parts of the connection, but i'm not sure (if the bea -> client connection remains active, the client then can renegotiate the connection without bea noticing it? and the server -> oracle connection?) Ok, i'm a little confused here :) Can you help me with this issue? Bye, dario.

1 0

New feature - PayPal donations
by Michal Trojnara 16 Oct '06

16 Oct '06

Dear Users, Since PayPal finally decided to provide full support for users in Poland I've added a donation button on the web page. http://stunnel.mirt.net/ I really appreciate each donation. 8-) Best regards, Mike

1 0

"Peer suddenly disconnected" after upgrade to 4.18
by Asarian 13 Oct '06

13 Oct '06

Hello, I'm a long time user of stunnel. Yesterday I finally upgraded to stunnel 4.18. Can't get it to work anymore, though. :( Here is the relevant part of my config: ----------------------- cert = /etc/stunnel.pem key = /etc/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH sslVersion = SSLv2 setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none [pop3s] accept = 995 exec = /usr/local/libexec/inet-qpopper execargs = inet-qpopper -s transparent = yes [imaps] accept = 993 exec = /usr/local/libexec/imapd execargs = imapd transparent = yes ----------------------- With the exception of a few keyword changes, this is the config I've always used. But I always get these errors now: Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.79.4:2576 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.1.4:2579 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The cert and key are good (I use em for Apache, too). I also tried SSLv3, but got this error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number But I like to get it working with SSLv2 first; then I'll worry about the other thing later. :) I hope someone can tell me what I'm doing wrong. Thanks, - Mark

1 0

SegFault with stunnel
by Beyerle, Christian 12 Oct '06

12 Oct '06

Hello Everyone, I try to encrypt a Mysql-Connection between two host which run Suse Linux 10.1. On the Server runs a mysql database, on the client runs barnyard (a plugin for snort) which should write into the mysql database. I installed stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 on both servers. The Configuration file on the Server (mysql) looks like: client = no debug = 7777777 output = /var/log/stunnel.log [mysqls] accept = 10439 connect = 127.0.0.1:3306 Stunnel seems to run well: lsof -i -n | grep stunnel stunnel 25330 stunnel 6u IPv4 371490 TCP *:10439 (LISTEN) On the client: [mysqls] client = yes accept = 127.0.0.1:3306 connect = 172.16.1.80:10439 Stunnel seems to run as well as on the server: stunnel 16634 stunnel 6u IPv4 22487 TCP 127.0.0.1:mysql (LISTEN) If i start barnyard that should connect to port 3306, barnyard cannot open the port and quits. I looked in my syslog and found the following entry: Oct 12 14:10:28 CLIENT kernel: stunnel[10991]: segfault at 0000000055697fb0 rip 000055555555b793 rsp 00005555556b0520 error 4 Oct 12 14:10:28 CLIENT barnyard[10997]: FATAL ERROR: Failed to connect to database snort:[email protected]/sensors: Lost connection to MySQL server during query Oct 12 14:10:28 CLIENT barnyard[10997]: Exiting I find no log of stunnel which help me to understand the reason of the crash. After this stunnel not too seem runnign anymore on the port: lsof -i -n | grep stunnel (no output) Does anybody have an idea??? Thank you for the help, -- Chris

1 0

[stunnel-users]Plan for new authorisation method in Stunnel
by Thomas Thiele 11 Oct '06

11 Oct '06

Hello Stunnel Users, I am planning to develop a new authorisation method for Stunnel which I need for work. This method will be an addition to the existing methods for checking certificates. The idea is to use the subject names and the alternative names of the certificates to allow or drop connections. The subject and alternative names of the machines/clients that are allowed to connect to the server will be written into the Stunnel config. While checking the certificates, the subject and alternative names from the Stunnel config will be compared with the subject and alternative names in the certirficate from the connection request. If one of the names from the Stunnel config matches with the names from the certificate then the connection will be allowed. This is the basic idea of my project. Is anyone already working on something like that or do you have any ideas or suggestions for me? Best Regards, Thomas Thiele -- GMX DSL-Flatrate 0,- Euro* - Überall, wo DSL verfügbar ist! NEU: Jetzt bis zu 16.000 kBit/s! http://www.gmx.net/de/go/dsl

2 1

libstunnel.so
by Andrew Schulman 05 Oct '06

05 Oct '06

The Debian stunnel (actually stunnel4) package includes /usr/lib/libstunnel.so. I have two questions about this file: (1) What is its purpose? ldd shows that /usr/bin/stunnel doesn't depend on it. So is this the shared library referred to in stunnel(1), under the 'transparent' option? The man page says that to use 'transparent' one has to LD_PRELOAD env.so, but I don't find any env.so. I see that env.c is used in building libstunnel.a, so I'm guessing that the man page meant to say libstunnel.so instead of env.so. (2) How does one build it? configure includes a --with-shared-libs option, but even when that's enabled I don't get a libstunnel.so when I build. And I can't find any make targets for any .so files. Yet Debian includes this file. Thanks, Andrew.

1 0

Configure can't find openssl in Ubuntu
by Tommi Nieminen 04 Oct '06

04 Oct '06

Hello, I have an Ubuntu 6.06.1 (Dapper) where I'm trying to install Stunnel. First I tried to install Stunnel using Ubuntu's package manager (apt-get install stunnel4). The installation went very smoothly but the fact that stunnel didn't recognize the -V switch left me with an uneasy feeling that something else might be lacking, too. The Ubuntu package in question contains Stunnel 4.14. Stunnel 3.26, installed from another package, does recognize the -V switch. So then I tried several times installing stunnel from source. A few obstacles I managed to overcome, but now that the configure script stops telling that it can't find SSL directory checking for SSL directory... Not found Couldn't find your SSL library installation dir Use --with-ssl option to fix this problem I'm out of resources. The script seems to check the existence of ssl.h file: checkssldir() { : if test -f "$1/include/openssl/ssl.h" Despite the fact that I have OpenSSL 0.9.8a on my machine, I don't have ssl.h file anywhere, I checked that with find. I tried installing Linux headers, but that didn't help (well I didn't expect it to help, but I couldn't think of anything). Is there some package I should get, that doesn't come with the openssl package or how should I solve this problem? Any ideas? Another problem that I had when I was experimenting with Stunnel 3.26 was the fact, that I couldn't start it up. It kept asking for the -r or -l switch. What I want to do with Stunnel is to decrypt the traffic coming in on one interface and then forward it to another machine through another interface. I tried several different configuration files, this is one of them (without indentations): cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 debug = 7 output = stunnel.log client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 I didn't get any debug information and -f switch didn't give anything more. I tried the Windows version (4.18) on another pc and it seemed to do exactly what I wanted. (the config file may have been slightly different, at least no debug was set. I really would like to get this working on a Linux box, too. Tommi Nieminen

3 3

Convert to SSL
by Bob 04 Oct '06

04 Oct '06

Hello all, I have been looking online at the examples but can't seem to quite figure out how to do this. We are currently using stunnel to receive SSL message and redirect them as regular messages but now I need to go the other way first. Is it possible to setup stunnel to receive an non-SSL messages and redirect it as an SSL message? and can this be done in the current config file or do I have to run 2 stunnel daemons? Also, the new one has to validate certificates. -- _______________________________________________________________________ Thanks, Bob (bobif(a)adelphia.net) YahooIM: bobifx AOLIM: bobifmd ICQ: 111083556

1 0

"SSL3_GET_RECORD:wrong version number" error
by James Brown 04 Oct '06

04 Oct '06

I am having problems connecting to stunnel and was hoping someone could help me. When starting stunnel and then trying to send an SSL-encrypted email through it I get: $ sudo /usr/local/sbin/stunnel /sw/etc/stunnel/stunnel.conf -D 465 -r 25 2006.10.04 11:03:28 LOG7[29230:2684415368]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: RAND_status claims sufficient entropy for the PRNG 2006.10.04 11:03:28 LOG7[29230:2684415368]: PRNG seeded successfully 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate: /Users/ jlbrown/%1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: Key file: /Users/jlbrown/% 1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Private key loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: SSL context initialized for service ssmtp 2006.10.04 11:03:28 LOG5[29230:2684415368]: stunnel 4.18 on powerpc- apple-darwin8.8.0 with OpenSSL 0.9.7i 14 Oct 2005 2006.10.04 11:03:28 LOG5[29230:2684415368]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.10.04 11:03:28 LOG6[29230:2684415368]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.10.04 11:03:28 LOG6[29230:2684415368]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.10.04 11:03:28 LOG5[29230:2684415368]: 125 clients allowed 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 6 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 7 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 8 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: SO_REUSEADDR option set on accept socket 2006.10.04 11:03:28 LOG7[29230:2684415368]: ssmtp bound to 0.0.0.0:465 James-Browns-Computer-2:~/stunnel-4.18 jlbrown$ 2006.10.04 11:03:28 LOG7[29231:2684415368]: Created pid file /usr/local/var/run/stunnel/ stunnel.pid 2006.10.04 11:08:08 LOG7[29231:2684415368]: ssmtp accepted FD=9 from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp started 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 9 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on local socket 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 11 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: Connection from 127.0.0.1:64235 permitted by libwrap 2006.10.04 11:08:08 LOG5[29231:25188864]: ssmtp connected from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:2684415368]: Cleaning up the signal pipe 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp connecting 127.0.0.1:25 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: waiting 10 seconds 2006.10.04 11:08:08 LOG6[29231:2684415368]: Child process 29421 finished with code 0 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: connected 2006.10.04 11:08:08 LOG7[29231:25188864]: Remote FD=10 initialized 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on remote socket 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): before/ connect initialization 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): SSLv3 write client hello A 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL alert (write): fatal: handshake failure 2006.10.04 11:08:08 LOG3[29231:25188864]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.10.04 11:08:08 LOG5[29231:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp finished (0 left) Any suggestions as to what is causing this and how I can fix it? I got the same thing on another machine, with stunnel 4.04 and OpenSSL 0.9.7d. My stunnel.conf file is: cert = /Users/jlbrown/%1.pem key = /Users/jlbrown/%1.pem debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Thanks, James.

2 1

Thanks
by Eric S. Eberhard 03 Oct '06

03 Oct '06

For the help ... I believe I got it. Was I got that debug bug fixed I could tell what was going on. In the end I just stopped fighting it and downloaded prngd and ran it for a while. Interestingly, once I did this, it continues to work fine w/out prngd up and running. It did something I don't understand to my random file (apparently the old one was not good enough) and now it works!##$ Don't understand it, but it works! I still have some other application problem but I appear to get responses now. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Re: [stunnel-users] Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Mike, Ah -- you are an expert! Amazing product in that I last download this in 2000 and have used it without incident ever since. Too bad I am forced to upgrade. I have hunted down the problem some more -- it has to do with the randomness. Using dbx I have found that it is blocking on a socked read for DEVRANDOM_EGD ... I did not specifically set up any sockets for randomness anyplace. Or set any options. I don't really want a socket, I was perfectly happy with my little 1024 byte .rnd file. If I copy a file (at random :-) ) and specify that it use that file for randomness, it reads it and sets it to zero bytes (unless I tell it not to overwrite). It then goes to read the socket and hangs. I suspect this is more an openssl problem than stunnel unless you can think of a way to 1) make it not wipe out my random file 2) make it not try and access a socket I hope you put my little fix in to s_log. Thanks, Eric At 01:51 PM 10/2/2006, you wrote: >On Monday 02 October 2006 21:19, you wrote: > > Are you an openssl/stunnel expert? > >I wrote stunnel. I could say I'm an expert (who an expert is otherwise?). > > > If I gave you access to my rs6000 > > and paid you, could you get this to work for me? Since I only need > > to compil this every 5-10 years, it makes little sense for me to > > invest a lot of time learning it! > >Good idea. > >Best regards, > Mike > This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

2 3

One bug solved/fixed -- bug in log.c or perhaps options.c
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Because I am using inetd mode, any unintended output by stunnel to stdout is BAD as this is accepted as input through inetd to my calling program. The problem with stunnel is that in main it does main_initialize which has the final function "log_open" However, somewhere in "parse_config" a call is made to "s_log" (with the text "Snagged 64 bytes from ..." and since this is before the log_open, the output ends up on stdout rather than being logged. Rather than try and hunt down the function that outputs the premature error message, I modified s_log to open the log files itself if not already open. I fixed it as follows (suggest you put in to the release?): void s_log(int level, const char *format, ...) { va_list arglist; char text[STRLEN], timestamped[STRLEN]; time_t gmt; struct tm *timeptr; #if defined(HAVE_LOCALTIME_R) && defined(_REENTRANT) struct tm timestruct; #endif if(level>options.debug_level) return; va_start(arglist, format); #ifdef HAVE_VSNPRINTF vsnprintf(text, STRLEN, format, arglist); #else vsprintf(text, format, arglist); #endif va_end(arglist); #if !defined (USE_WIN32) && !defined (__vms) /******************** NEW CODE, NEXT 2 LINES *******/ if(!outfile && options.output_file) /* 'output' option specified, not open */ log_open(); if(!outfile && options.option.syslog) { syslog(level, "LOG%d[%lu:%lu]: %s", So now I don't get the "Snagged" message back on stdout ... but it still does not work for me (yet :-) ) Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Setting up TLS for SMTP
by James Brown 01 Oct '06

01 Oct '06

I am trying to set up stunnel so that it accepts SSL encrypted traffic from the internet on port 2525 and sends it to my mail server on port 25. To create the certificate, I used: sudo openssl req -new -outform PEM -out smtpd.cert \ -newkey rsa:2048 -nodes -keyout smtpd.key -keyform PEM \ -days 365 -x509 My stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem cert = /smtpd.cert ;key = stunnel.pem key = /smtpd.key ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini I am trying it in standalone mode. Using Stunnel 4.04. OpenSSL 0.9.7i 14 Oct 2005 Output of gcc -v is: Using built-in specs. Target: powerpc-apple-darwin8 Configured with: /private/var/tmp/gcc/gcc-5341.obj~1/src/configure -- disable-checking -enable-werror --prefix=/usr --mandir=/share/man -- enable-languages=c,objc,c++,obj-c++ --program-transform-name=/^[cg] [^.-]*$/s/$/-4.0/ --with-gxx-include-dir=/include/c++/4.0.0 --with- slibdir=/usr/lib --build=powerpc-apple-darwin8 --host=powerpc-apple- darwin8 --target=powerpc-apple-darwin8 Thread model: posix gcc version 4.0.1 (Apple Computer, Inc. build 5341) Whenever I try to start Stunnel, I get a message saying that there is no such file. Eg: $ stunnel -p /smtpd.cert -d 2525 -r 25 2006.10.01 00:36:46 LOG3[638:2684415368]: -p: No such file or directory (2) Syntax: stunnel [filename] | -help | -version | -sockets filename - use specified config file instead of /sw/etc/ stunnel/stunnel.conf -help - get config file help -version - display version and defaults -sockets - display default socket options I am using Mac OS X 10.4.8, Stunnel was built using Fink. Does anybody have any suggestions as to what I am doing wrong? Thanks, James.

1 0

stunnel on osX
by fmgre-dell＠yahoo.fr 30 Sep '06

30 Sep '06

>From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> >Subject: Re: [stunnel-users] Tr: failure notice >To: stunnel-users(a)mirt.net >Message-ID: <200609292118.57291.Michal.Trojnara(a)mobi-com.net> >Content-Type: text/plain; charset="utf-8" >On Friday 29 September 2006 16:11, fmgre-dell(a)yahoo.fr wrote: >> We have been using stunnel for 2 years now. >> We need to renew our keys, and we usually proceed to a >> software upgrade at the same time. >> Â >> - I have noticed changes in stunnel-client ( 4.16 ) >> running on OSX : now, stunnel asks for the key >> password for each service it is launching. > >Just password from your private key. 8-) > Hello, What i mean is that we have 8 different services running. they are all locked with the same key. We distribute the private key to other non-computer persons, who don t know how to remove a password from a key ( and we 'd like to keep the key locked ) With the former version of stunnel, we could unlock the 8 services with typing the password only once With the latest version, we need to type in the keyword once for every service ( i.e. 8 times !!! ) Is there any way to 'ease' the use of the latest version while keeping the key passworded ? bon week end fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

Help please - debug and random file
by Eric S. Eberhard 29 Sep '06

29 Sep '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Tr: failure notice
by fmgre-dell＠yahoo.fr 29 Sep '06

29 Sep '06

Hello, We have been using stunnel for 2 years now. We need to renew our keys, and we usually proceed to a software upgrade at the same time. - I have noticed changes in stunnel-client ( 4.16 ) running on OSX : now, stunnel asks for the key password for each service it is launching. - a collegue is running stunnel ( client ) on windows and told me that the 4.15 and 4.16 version keeps on crashing on windows. Anybody with the same symptoms ( and possiby a workaround ? ) :-) ( we use keys which are protected by a password, we launch the stunnel ( client ) manually and type in the password for the service to start ) Sincerely, Fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

create_client failed
by James 29 Sep '06

29 Sep '06

I am running Debian 3.1 (stable) with stunnel 3.26 (Debian package) to wrap my qmail pop3 daemon. Stunnel works properly for a good amount of time, but at a point (I am unable to find any specific influencing factors) it begins to fail with the error, "Connection reject: create_client failed" (see below for more info). To fix the error I have to kill and restart stunnel. I have adjusted the timeouts for both stunnel and the pop3 daemon, but nothing appears to have a lasting affect. When stunnel errors out the pop3 daemon is still available and can be connected to, so it does not appear to be an issue related to stunnel not being able to talk to the pop3 daemon. Below I have some of the debugging and system information regarding the system and problem. I would be more than appreciative if anyone had some input. Thank you. # Error stunnel[2500]: pop3 accepted FD=9 ###.###.###.### stunnel[2500]: Connection rejected: create_client failed # strace -p select(7, [4 6], NULL, NULL, NULL) = 1 (in [6]) fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 accept(6, {sa_family=AF_INET, sin_port=htons(63759), sin_addr=inet_addr("###.###.###.###")}, [16]) = 9 fcntl64(6, F_SETFL, O_RDWR) = 0 fcntl64(9, F_SETFD, FD_CLOEXEC) = 0 rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM CHLD], [], 8) = 0 mmap2(NULL, 8388608, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 close(9) = 0 time([1159535901]) = 1159535901 getpid() = 21864 rt_sigaction(SIGPIPE, {0x40253a70, [], 0}, {SIG_IGN}, 8) = 0 send(3, "<27>Sep 29 09:18:21 stunnel[2186"..., 77, 0) = 77 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 close(9) = -1 EBADF (Bad file descriptor) # uname -a 2.6.8-3-686-smp #1 SMP Thu Sep 7 04:39:15 UTC 2006 i686 GNU/Linux # libc version GNU C Library stable release version 2.3.2 # Command Running /usr/sbin/stunnel -d pop3s -r pop3 -p /etc/ssl/certs/pop3d.pem -R /dev/urandom -s nobody -g root # stunnel -V stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory /etc/ssl/certs -A file (none) -S sources 3 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /var/run/stunnel/ -p pemfile in server mode: /etc/ssl/certs/stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0

1 0

SSL and keep alive
by Alex Turner 29 Sep '06

29 Sep '06

All, I am load testing stunnel as a front end to a web server. The problem I have is that the connection is dropping even though JMeter is set to keep-alive on the http sampler. I was wondering if anyone knew if this was a JMeter issue – IE it does not do http1.1 properly with SSL or should I dig deeper? The stunnel log just shows the socket being closed down at the end of each request. Now – as stunnel should not care what data is going over ssl, then there must be something from JMeter that is triggering it to drop the socket. My thinking is that this is either an SSL session end or an actual FIN. In the absence of any feedback – I think I will try using stunnel in both client and server modes and, as I already know JMeter is OK at keep-alive non https – I should thus find out where the issue lays. Thanks for any info AJ PS – I am working on XP both ends with JMeter 2.2 and the latest stunnel. PPS – Naturally, once I have this figured I will post the method and results to nerds-central Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.12.9/457 - Release Date: 26/09/2006

2 3

Zombies in 4.17?
by Pete Resnick 28 Sep '06

28 Sep '06

I'm running 4.17 on a Mac Mini (Intel) running MacOSX 10.4.7 and I'm seeing a slew of zombies. Anything I can do to track down what the problem is? pr -- Pete Resnick <http://www.episteme-software.com/> All connections to the world are tenuous at best

2 2

stunnel 4.18 released
by Michal Trojnara 26 Sep '06

26 Sep '06

Version 4.18, 2006.09.26, urgency: MEDIUM: * Bugfixes - GPF on entering private key pass phrase on Win32 fixed. - Updated Win32 OpenSSL DLLs. - Minor configure script update. Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.18.tar.gz: 3ed3eaefae91d80fcfcbb29dd285d0f773756397 Best regards, Mike

1 0

Windows OpenSSL DLL Version
by algol sigfrid 26 Sep '06

26 Sep '06

2 1

seg fault stunnel 4-14 on SLES10
by Jon Howse 22 Sep '06

22 Sep '06

Hi, I am getting a seg fault with stunnel on an installation of SLES10. This is the first SLES10 server I have set up after having set up many SLES9 servers (approx twelve) which all communicate through stunnel to a central syslog server. The version of stunnel we are using on SLES9 is: stunnel-4.05-20.1. The other machines are a mix of 32bit and 64bit Xeons. The seg fault seems to happen when syslog starts to talk through stunnel. The program is a binary rpm install for 64bit SLES10 and is being run in standalone mode as a client connecting to a stunnel/syslog server running SLES9. OS:- SLES10 x86_64 Packages:- Stunnel 4-14-14.2 Syslog-ng-1.6.8-20.4 Openssl-0.9.8a-18.4 uname -a: Linux server 2.6.16.21-0.15-smp #1 SMP Tue Jul 25 15:28:49 UTC 2006 x86_64 x86_64 x86_64 GNU/Linux libc version: libc.so.6 => /lib64/libc.so.6 (0x00002ae068cf2000) openssl version: OpenSSL 0.9.8a 11 Oct 2005 stunnel.conf:- # Copyright by Michal Trojnara 2002-2004 # --with changes for SuSE package # client = yes | no # client mode (remote service uses SSL) # default: no (server mode) client = yes # # chroot + user (comment out to disable) # chroot = /var/lib/stunnel/ setuid = stunnel setgid = nogroup # note about the chroot feature and the "exec" keyword to start other # services... # while the init script /etc/init.d/stunnel will copy the binaries and libraries # into the chroot jail, more files might be needed in the jail (configuration files etc.) pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /var/log/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # compression = rle # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff # verify = 2 # Don't forget to c_rehash CApath; CApath is located inside chroot jail: # CApath = /certs # It's often easier to use CAfile: # CAfile = /etc/stunnel/certs.pem # Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: # CRLpath = /crls # Alternatively you can use CRLfile: # CRLfile = /etc/stunnel/crls.pem CAfile = /etc/openldap/rootcert.pem cert = /etc/ssl/certs/thorincert.pem key = /etc/ssl/certs/thorinkey.pem verify = 2 [5140] accept = 127.0.0.1:514 connect = xxx.xxx.xxx.xxx:5140 /var/log/messages:- kernel: Kernel logging (proc) stopped. Sep 21 13:51:00 thorin kernel: Kernel log daemon terminating. Sep 21 13:51:01 thorin syslog-ng[3146]: syslog-ng version 1.6.8 going down Sep 21 13:51:01 thorin syslog-ng[3769]: syslog-ng version 1.6.8 starting Sep 21 13:51:01 thorin syslog-ng[3769]: Changing permissions on special file /dev/tty10 Sep 21 13:51:01 thorin syslog-ng[3769]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Sep 21 13:51:06 thorin kernel: klogd 1.4.1, log source = /proc/kmsg started. Sep 21 13:51:06 thorin kernel: stunnel[3739]: segfault at 000000005569a9f0 rip 000055555555b793 rsp 00005555556b2f60 error 4 var/log/stunnel.log:- stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2006.09.21 13:48:25 LOG7[3396:1]: RAND_status claims sufficient entropy for the PRNG 2006.09.21 13:48:25 LOG6[3396:1]: PRNG seeded successfully 2006.09.21 13:48:25 LOG7[3396:1]: Certificate: /etc/ssl/certs/thorincert.pem 2006.09.21 13:48:25 LOG7[3396:1]: Key file: /etc/ssl/certs/thorinkey.pem 2006.09.21 13:48:25 LOG7[3396:1]: Loaded verify certificates from /etc/openldap/rootcert.pem 2006.09.21 13:48:25 LOG6[3396:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.09.21 13:48:25 LOG6[3396:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.09.21 13:48:25 LOG5[3396:1]: 500 clients allowed 2006.09.21 13:48:25 LOG7[3396:1]: FD 4 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 5 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 6 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: SO_REUSEADDR option set on accept socket 2006.09.21 13:48:25 LOG7[3396:1]: 5140 bound to 127.0.0.1:514 2006.09.21 13:48:25 LOG7[3397:1]: Created pid file /var/run/stunnel.pid 2006.09.21 13:48:25 LOG7[3397:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=4, (IN)->() 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.09.21 13:49:20 LOG7[3397:1]: 5140 accepted FD=7 from 127.0.0.1:7323 2006.09.21 13:49:20 LOG7[3397:1]: Creating a new context 2006.09.21 13:49:20 LOG7[3397:1]: Context 2 created 2006.09.21 13:49:20 LOG7[3397:2]: Context swap: 1 -> 2 It waits at the last entry until syslog tries to connect. And that's where the useful logging stops, after that it's a seg fault. Hope you can point me in the right direction... Jon Howse ---------------------------------------------------------------------------- St Brendan's Sixth Form College --- STAFF e-mail Please consider the environment before printing this email. This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of St Brendan's Sixth Form College. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender. Please report any abuse of this e-mail service to postmaster(a)stbrn.ac.uk ---------------------------------------------------------------------------- *** This e-mail has been scanned by Symantec Anti-Virus software. ***

1 0

Would you plz help me? I have problem with defining ciphers in stunnel
by hjanzadeh＠sinamicro.com 19 Sep '06

19 Sep '06

1 0

4.17 stunnel with syslog-ng
by Jason Englander 15 Sep '06

15 Sep '06

I have a logging server at home set up with syslog-ng and stunnel. Earlier this morning, I upgraded stunnel on a logging client machine from 4.15 to 4.17, no problems. I upgraded the server from 4.15 to 4.17 and stunnel seemed to hang (run, but not detach) on startup. Very long story short (it was too early, I hadn't had enough coffee yet <g>), stunnel was trying to log to syslog, which wasn't running yet. Putting aside that I should've been using "output = /var/log/stunnel.log" instead, for a log server of all things :-), did something change in stunnel or did I screw something up that I don't remember doing? My startup script has been starting stunnel, then syslog-ng for years. I haven't downgraded to verify that it does/doesn't happen starting with a particular version, but I might do that later today out of curiosity. (before fixing, upgrading "important" machines) Also, FYI - configure created a file named "6," in the source directory with this in it: no LIBS=-lz -ldl -lutil -lpthread -L/usr/local/ssl/lib -lssl -lcrypto This seems to be the offending line in configure: echo "${ECHO_T}no" >&6, LIBS="$saved_LIBS" -> echo "${ECHO_T}no" >&6; LIBS="$saved_LIBS" I ran 'autoreconf -f -i' (autoconf 2.60, automake 1.9.6) and the line isn't in the new ./configure any more. Jason -- Jason Englander <jason(a)englanders.cc> 394F 7E02 C105 7268 777A 3F5A 0AC0 C618 0675 80CA

2 1

cannot compile stunnel on solaris 10 in a zone
by tomvo＠absi.be 15 Sep '06

15 Sep '06

Hi, I'm trying to compile stunnel on a solaris 10 (06/06 release) in a normal (non-global) zone. the compile fails at the mknod command. How do I install stunnel ? I could ofcourse create the device myself in the global zone, but i think it was in /usr/local/var/lib/stunnel/dev, I don't think that our user zone will have access to this device if we create it in the global zone. Anyone else struggled with the same problem ? thx, Tom. --------------------------------------------------------------------------- Tom Van Overbeke - ABSI Service Delivery Coordinator email: tomvo(a)absi.be Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60 website: http://www.absi.be ---------------------------------------------------------------------------

1 0

stunnel problem on hp-ux 11.11
by matt.miller＠accenture.com 13 Sep '06

13 Sep '06

System specs: HP-UX 11.11 Stunnel 4.15 OpenSSL 0.8.7i Config File: ; Certificate/key is needed in server mode and optional in client mode ;cert = /opt/iexpress/stunnel/etc/stunnel/mail.pem ;key = /opt/iexpress/stunnel/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /opt/iexpress/stunnel/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /tmp/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /opt/iexpress/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /opt/iexpress/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;foreground = yes output = stunnel.log ; Service-level configuration [pop3s] ; Use it for client mode client = yes ;accept = 995 ;connect = 110 accept = localhost:110 connect = POP3S.MAILSERVER:995 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Problem: When I try to execute the following command "telnet localhost 110" I get an entry in the stunnel log file and I am unable to connect to the secure pop3 server. I know that this is not a firewall issue because I can telnet directly to the POP3S.MAILSERVER on port 995 and establish a connection, I also know that the server works fine because I set up stunnel on my windows xp machine and that did not have a problem establishing a connection. Any help on this issue would be great. Here is the log I am getting 2006.08.10 18:23:03 LOG5[16138:1]: stunnel 4.15 on hppa2.0w-hp-hpux11.11 with Op 2006.08.10 09:43:55 LOG5[7158:1]: 2000 clients allowed 2006.08.10 09:43:55 LOG7[7158:1]: FD 4 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 5 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 6 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: SO_REUSEADDR option set on accept socket 2006.08.10 09:43:55 LOG7[7158:1]: pop3s bound to 127.0.0.1:110 2006.08.10 09:43:55 LOG7[7263:1]: Created pid file /tmp/stunnel.pid 2006.08.10 16:15:45 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57040 2006.08.10 16:15:45 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:30:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57156 2006.08.10 16:30:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:45:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57275 2006.08.10 16:45:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:00:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57401 2006.08.10 17:00:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:15:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57506 2006.08.10 17:15:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:30:35 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57614 2006.08.10 17:30:35 LOG3[7263:1]: Connection rejected: create_client failed Matt T. Miller Accenture Minneapolis, MN USA 612-277-1826 aim: mttmiller8 email: matt.miller(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

RE: [stunnel-users] stunnel and AJP
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Any chance you could send me a sample configuration file? :) Just got it install and going to start trying to get it setup. I am going to try to end the tunnel on a BigIP box. So just set it up on the apache server and hope it can end on the BigIP box. Thanks -----Original Message----- From: Richard.Hall [mailto:[email protected]] Sent: Friday, August 25, 2006 4:08 PM To: Jones Scott - sjones Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel and AJP Jason, On Fri, 25 Aug 2006, Jones Scott - sjones wrote: > Has anyone used stunnel to secure AJP traffic from apache to jboss Short answer: Yes. - Apache + mod_jk configured to talk to stunnel client on localhost rather than to JBoss AJP13 port - stunnel client talks to remote stunnel server - stunnel server talks to JBoss AJP13 port on _its_ localhost. Works a treat :-) We've even done it with a third machine in the middle, running an stunnel server and client back-to-back. Just don't ask why! HTH, Richard ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users