- stunnel-users - stunnel.org

Re: [stunnel-users] Win: sometines don't connect
by Miroslav Geisselreiter 04 Dec '06

04 Dec '06

Hi My comments inline .... >>>>>> Miroslav Geisselreiter <mg(a)intar.cz> 12/01/06 8:04 PM >>> <SNIP> someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 I doubt how the "connect" option can be configured like this? should n't it be "connect = <yourfirstPC>:5900" and the accpet option should be "somotherpc:5600" <SNIP> Hope this helps! Regards Prem I think it is correct. On the first PC stunnel listens on localhost:5900 and passes securelly to second PC to port 5600. VNC on first PC connect to localhost port 5900. On the second PC stunnel accepts connection from any PC on port 5600 and passes to localhost (still second PC) to port 5900. VNC on second PC listens on port 5900. Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.6/566 - datum vydani: 3.12.2006 16:36

1 0

performance configuration for rehl3 & JBoss
by Jones Scott - sjones 01 Dec '06

01 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

1 0

Win: sometines don't connect
by Miroslav Geisselreiter 01 Dec '06

01 Dec '06

Hi, I use stunnel 4.16 on Windows 2000 and XP with this simple config: cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes verify = 3 [VNC2] accept = localhost:5900 connect = someotherpc:5600 When I start stunnel (as Win service), sometimes it forwards to someotherpc:5600 (it is correct) but sometimes it doesn't. Here is the debug 7 info: 2006.12.01 14:52:32 LOG7[3676:4060]: RAND_status claims sufficient entropy for the PRNG 2006.12.01 14:52:32 LOG7[3676:4060]: PRNG seeded successfully 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Key file: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Private key loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Loaded verify certificates from cacerts.pem 2006.12.01 14:52:32 LOG7[3676:4060]: SSL context initialized for service VNC2 2006.12.01 14:52:32 LOG5[3676:4060]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.12.01 14:52:32 LOG5[3676:4060]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.12.01 14:52:32 LOG5[3676:3108]: No limit detected for the number of clients 2006.12.01 14:52:32 LOG7[3676:3108]: FD 180 in non-blocking mode 2006.12.01 14:52:32 LOG7[3676:3108]: SO_REUSEADDR option set on accept socket 2006.12.01 14:52:32 LOG7[3676:3108]: VNC2 bound to 127.0.0.1:5900 When it doesn't work correcly, it stops here, otherwise continues: 2006.12.01 14:52:34 LOG7[3676:3108]: VNC2 accepted FD=188 from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:3108]: Creating a new thread 2006.12.01 14:52:34 LOG7[3676:3108]: New thread created 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 started 2006.12.01 14:52:34 LOG7[3676:4008]: FD 188 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on local socket 2006.12.01 14:52:34 LOG5[3676:4008]: VNC2 connected from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:4008]: FD 212 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 connecting 192.168.1.172:5600 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: waiting 10 seconds 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: connected 2006.12.01 14:52:34 LOG7[3676:4008]: Remote FD=212 initialized 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on remote socket 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): before/connect initialization 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client hello A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server hello A 2006.12.01 14:52:34 LOG6[3676:4008]: *** starting OCSP verification *** 2006.12.01 14:52:34 LOG5[3676:4008]: VERIFY OK: depth=0, some info .... 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate request A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server done A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client key exchange A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write certificate verify A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write change cipher spec A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write finished A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 flush data 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read finished A 2006.12.01 14:52:34 LOG7[3676:4008]: 1 items in the session cache 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects (SSL_connect()) 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 client renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects (SSL_accept()) 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache hits 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache misses 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache timeouts 2006.12.01 14:52:34 LOG6[3676:4008]: SSL connected: new session negotiated 2006.12.01 14:52:34 LOG6[3676:4008]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 It runs as win service too. Please help. -- Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.3/562 - datum vydani: 1.12.2006 13:12

2 1

HTTPS proxy authentication
by Brett.Carroll＠bpd.treas.gov 01 Dec '06

01 Dec '06

I am trying to get stunnel to work through a HTTPS proxy but the current version doesn't seem to include the patch for this. Does the latest version (4.20) include https proxying support?

1 0

Problem in Stunnel with too many connections
by ~ Kunal Sharma ~ 01 Dec '06

01 Dec '06

Hi Friends, I've just joined this group. I would take this as an oppurtunity to discuss a problem I've been facing in using Stunnel. I've been using Stunnel for quite some time now. It has worked very well all this while. Recently, I had to shift our webserver onto the Internet and Stunnel accepts the https connections on the server's behalf. The problem is there are about 4.5 million clients out there in the field and there's a client coming up to the server atleast every second, if not less. Stunnel accepts the connections and after a while (like an hour) it just dies ! I see that at a point there are about 950 active connections and thats the maximum I could see before it dies. Could someone help me diagnose the problem (or better to fix it) - Is there any performance related issue thats a known problem and I don't know of ? - What I can look at to see what could be the possible cause ? - I haven't had a chance to look at the logs yet. Probably they might tell me something. - Any other pointers / inputs / suggestions would be heartily welcome. I've not been to my office so I won't be able to attach the necessary information like the version of stunnel, the logs, configuration options etc. But promise to send them as soon as I'm back on Monday after Thanksgiving. Thanks and Regards, Kunal

4 8

stunnel 4.20 released
by Michal Trojnara 30 Nov '06

30 Nov '06

Dear Users, I have just released a new version of stunnel. Here is the ChangeLog entry: Version 4.20, 2006.11.30, urgency: MEDIUM: * Release notes - The new transfer() function has been well tested. I recommend upgrading any previous version with this one. * Bugfixes - Fixed support for encrypted passphases (broken in 4.19). - Reduced amount of debug logs. - A minor man page update. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.20.tar.gz fie: a9a449b28a4f34ab22f6b4bfaa81c1904a5883c4 Best regards, Mike

1 0

Adding header to SMTP msgs
by Eric B. 27 Nov '06

27 Nov '06

Hi, I am looking at stunnel as a way to add SSL/TLS to an SMTP server, but my issue is that the SMTP server must be able to determine the address of the incoming connection to perform RBL checks, reverse MX record checks, PTR checks, etc. From what I can understand, however, the SMTP server will only see the client side of the pipe (localhost) as the originating address, instead of the originating machine IP. Is there any way to get the SMTP server to see that original IP address? Or baring that, is there anyway that stunnel can insert a header into the mail indicating the original IP address? Thanks! Eric

2 4

must restart stunnel to add a new cert before it recognized it...
by Rami Michael 22 Nov '06

22 Nov '06

Hello everyone, My stunnel setup is working fine, got mysql being hit from a couple of boxes but my question is this... I have stunnel setup so i copy the cert created from the remote client over to the local server so remote connections are authenticated. Now that works fine and dandy, the issue is, if i am adding a new remote client, i add the cert from the client to my certs.pem locally but i need to restart the stunnel process before stunnel will "read in" the new cert. I know this does not sound like a big deal, but if i have 20 machines connected through stunnel to this local box and i need to restart stunnel whenever i need to add a new box or take off an old one, i don't think its good. I use stunnel for mysql so i got these guys doing inserts and a broken connection would really mess things up for me... i think maybe there is a flag i can set? or maybe send the process some type of command to reload the certs? Any help would be appreciated... all relevant info included below. All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no [mysqls] accept = 3309 connect = 3306 Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

4 7

s_poll_wait timeout errors
by James Brown 17 Nov '06

17 Nov '06

I'm trying to set up an SSL connection from stunnel to Postfix, but can not get it to work. stunnel log says: 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 9 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on local socket 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 11 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: Connection from 192.168.1.12:51469 permitted by libwrap 2006.11.16 11:35:31 LOG5[5240:25188864]: ssmtp connected from 192.168.1.12:51469 2006.11.16 11:35:31 LOG7[5240:25188864]: FD 10 in non-blocking mode 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp connecting 127.0.0.1:25 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: waiting 10 seconds 2006.11.16 11:35:31 LOG7[5240:25188864]: connect_wait: connected 2006.11.16 11:35:31 LOG7[5240:25188864]: Remote FD=10 initialized 2006.11.16 11:35:31 LOG7[5240:25188864]: TCP_NODELAY option set on remote socket 2006.11.16 11:35:31 LOG5[5240:25188864]: Negotiations for smtp (client side) started 2006.11.16 11:35:31 LOG7[5240:2684415368]: Cleaning up the signal pipe 2006.11.16 11:35:31 LOG6[5240:2684415368]: Child process 5251 finished with code 0 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> 220 mail3.bordo.com.au ESMTP Postfix 2006.11.16 11:35:31 LOG7[5240:25188864]: -> EHLO localhost 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-mail3.bordo.com.au 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-SIZE 10240000 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ETRN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-AUTH=PLAIN LOGIN 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-XFORWARD NAME ADDR PROTO HELO SOURCE 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-ENHANCEDSTATUSCODES 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250-8BITMIME 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 250 DSN 2006.11.16 11:35:31 LOG7[5240:25188864]: -> STARTTLS 2006.11.16 11:35:31 LOG7[5240:25188864]: <- 220 2.0.0 Ready to start TLS 2006.11.16 11:35:31 LOG5[5240:25188864]: Protocol negotiations succeded 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): before/ connect initialization 2006.11.16 11:35:31 LOG7[5240:25188864]: SSL state (connect): SSLv2/ v3 write client hello A 2006.11.16 11:40:31 LOG6[5240:25188864]: init_ssl: s_poll_wait timeout 2006.11.16 11:40:31 LOG5[5240:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.16 11:40:31 LOG7[5240:25188864]: ssmtp finished (0 left) 2006.11.16 11:35:31 LOG7[5240:25188864]: ssmtp started Postfix's log shows: Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: connect from localhost[127.0.0.1] Nov 16 11:35:31 Fax-Machine postfix/smtpd[5252]: setting up TLS connection from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: SSL_accept error from localhost[127.0.0.1]: -1 Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: lost connection after STARTTLS from localhost[127.0.0.1] Nov 16 11:40:31 Fax-Machine postfix/smtpd[5252]: disconnect from localhost[127.0.0.1] stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration protocol = smtp sslVersion = all ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] client = yes accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Does anyone have any idea where I am going wrong? Thanks, James.

3 4

stunnel : remote connection refused
by Arunkumar Arumugam 16 Nov '06

16 Nov '06

Hi I am using stunnel 3.26 on i386 redhat -linux-gnu with PTHREAD+LIBWRAP with openssl 0.9.6b engine I am getting the following error when try to use stunnel to a remote ipadress on specific port Lets say the remote ip address be a.b.c.d and port P1 and local ipaddess e.f.g.h and port P2 e.f.g.h:P2 ------> a.b.c.d:P1 my logs say that a.b.c.d:p1 started a.b.c.d:p1 connected from 127.0.0.1:xxxxx a.b.c.d:p1 connecting a.b.c.d:p1 remote connect: connection refused (111) failed to initialize remote desccriptor abcd:p1 finished (0 left) I do not understand why after connecting from local host to a.b.c.d , a.b.c.d tries to reconnect to itself. I have the same setup in another server, it works fine. This one was working fine, until i rebooted the machine. Regards Arun A -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

Testing stunnel 4.19
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, Please test stunnel 4.19 in you environments and post any problem to the list, so I can fix it in stunnel 4.20 (to be released soon). I expect stunnel 4.20 to be the recommended stable release for quite a long time. 8-) Best regards, Mike

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

On Wednesday 15 November 2006 16:30, joe(a)strout.net wrote: > That's good news! ...But, how do I use it (in daemon mode)? I tried > launching stunnel with an encrypted key, and it simply failed saying > that the pass phrase was wrong. But it never asked me for a pass > phrase. How do I make it do so? I confirm it's broken in stunnel 4.19. I'll fix it in 4.20. 4.18 works fine. Best regards, Mike

1 1

Re: [stunnel-users] No way to keep the key encrypted?
by Hans Werner Strube 15 Nov '06

15 Nov '06

Michal Trojnara wrote: > Obviously private key encryption should not be used in inetd mode. It > works fine in daemon mode and on Win32 platform. Yes, but only when stunnel is started manually. When started automatically on system boot, there is usually nobody present to enter the password of the encrypted private key (except when the key is stored somewhere and its input provided by some script or program - again a security hole). This is not a special problem of stunnel but of all SSL-using servers.

1 0

Re: [stunnel-users] No way to keep the key encrypted?
by Michal Trojnara 15 Nov '06

15 Nov '06

Joe Strout wrote: > The private key cannot be encrypted [cut] > This seems very dangerous to me; This paragraph of the manual was obsolete so I've removed it. Obviously private key encryption should not be used in inetd mode. It works fine in daemon mode and on Win32 platform. Best regards, Mike

1 0

"wrong version number" error
by joe＠strout.net 15 Nov '06

15 Nov '06

With a cleartext key (see previous thread), I'm able to get stunnel to actually run. However, it's failing when I try to connect to my server with https, generating the following output: 2006.11.15 09:10:11 LOG5[18343:25188864]: https accepted connection from 67.174.105.26:39907 2006.11.15 09:10:11 LOG7[18343:25188864]: SSL state (accept): before/accept initialization 2006.11.15 09:10:11 LOG3[18343:25188864]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.11.15 09:10:11 LOG5[18343:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.11.15 09:10:11 LOG7[18343:25188864]: https finished (0 left) The important part here I suppose is "SSL routines:SSL3_GET_RECORD:wrong version number". Can anyone elaborate on what this means, and what I can do about it? Thank you, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

No way to keep the key encrypted?
by joe＠strout.net 15 Nov '06

15 Nov '06

I see from the manual: "Two things are important when generating certificate-key pairs for stunnel. The private key cannot be encrypted, because the server has no way to obtain the password from the user. To produce an unencrypted key add the -nodes option when running the req command from the OpenSSL kit." This seems very dangerous to me; anybody who gets ahold of that key file will then be able to impersonate my server, right? Symbian SSL Proxy will simply ask me for my pass phrase when I launch it. Is there any way to get stunnel to do something equivalent -- maybe by decrypting it on the fly and piping it to stunnel on launch, so that there is never a decrypted file on disk? Or maybe I can decrypt the key to a file, launch stunnel, and then immediately delete that file? How have others dealt with this? Thanks, - Joe -- Joe Strout -- joe(a)strout.net Verified Express, LLC "Making the Internet a Better Place" http://www.verex.com/

1 0

[RE][stunnel-users] ciphers=EDH-RSA-DES-CBC3-SHA
by algol sigfrid 15 Nov '06

15 Nov '06

2 1

Stunnel 4.19 released
by Michal Trojnara 15 Nov '06

15 Nov '06

Dear Users, A new version of stunnel has just been released. Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * New features - New service-level option to specify OCSP server flag: OCSPflag = <flag> - "protocolCredentials" option changed to "protocolUsername" and "protocolPassword" - NTLM support to be enabled with the new service-level option: protocolAuthentication = NTLM - imap protocol negotiation support added. - Passphrase cache was added so the user does not need to reenter the same passphrase for each defined service any more. - New service-level option to retry connect+exec section: retry = yes|no - Local IP and port is logged for each established connection. - Win32 DLLs for OpenSSL 0.9.8d. * Bugfixes - Serious problem with SSL_WANT_* retries fixed. The new code requires extensive testing! Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.19.tar.gz: d58da8117278d71598279c77935585de81b74394 Best regards, Mike

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 15 Nov '06

15 Nov '06

So it seems i found the answer to my own question... compression was added in stunnel 4.06. I am using 4.05 :)

1 0

Does stunnel supports IPv6
by Ravi Gowda 14 Nov '06

14 Nov '06

Hi All, Can we use ipv6 addresses in stunnel? The problem that I am facing is I want to have secure ldap sessions using two IPv6 systems but none of them speak SSL... How to go about it??? Thanks in Advance Ravi Gowda

2 1

Error when I try adding compression to stunnel.conf
by Rami Michael 14 Nov '06

14 Nov '06

Hey everyone, I was going through the stunnel FAQ when I noticed you could add compression. I was very excited and wanted to give it a try but when I tried to add compression = zlib to my stunnel.cong I got this error when starting stunnel... Starting stunnel: file /etc/stunnel/stunnel.conf line 10: Specified option name is not valid here Line 10 is the exact place where i stuck this name value pair. I don't know where else i could put it, i tried putting it everywhere! All requested info for posts to the group are found below Here is my stunnel.conf verify = 3 CAfile = /etc/stunnel/certs.pem cert = /etc/stunnel/stunnel.pem setuid = nobody setgid = nobody pid = /tmp/stunnel.pid debug = 7 output = /var/log/stunnel.log client = no compression = zlib [mysqls] accept = 3309 connect = 3306 I am using centOS and installed stunnel and openssl via the available rpms, using yum. zlib is installed as well, but i don't think this is a zlib issue, it seems like it just doesn't like "compression". Was compression added in a version later than 4.05? Am i missing something incredinbly simple? Some output from the stunnel.log at high debug level 2006.11.13 23:03:10 LOG5[32244:3086689984]: stunnel 4.05 on i686-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.11.13 23:03:10 LOG7[32244:3086689984]: Snagged 64 random bytes from /dev/urandom 2006.11.13 23:03:10 LOG7[32244:3086689984]: RAND_status claims sufficient entropy for the PRNG 2006.11.13 23:03:10 LOG6[32244:3086689984]: PRNG seeded successfully 2006.11.13 23:03:10 LOG7[32244:3086689984]: Certificate: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Key file: /etc/stunnel/stunnel.pem 2006.11.13 23:03:10 LOG7[32244:3086689984]: Loaded verify certificates from /etc/stunnel/certs.pem 2006.11.13 23:03:10 LOG5[32244:3086689984]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 4 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: SO_REUSEADDR option set on accept socket 2006.11.13 23:03:10 LOG7[32244:3086689984]: mysqls bound to 0.0.0.0:3309 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 5 in non-blocking mode 2006.11.13 23:03:10 LOG7[32244:3086689984]: FD 6 in non-blocking mode 2006.11.13 23:03:10 LOG7[32245:3086689984]: Created pid file /tmp/stunnel.pid stunnel -V 2006.11.13 23:03:14 LOG3[32248:3086505664]: -V: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options uname -a Linux ramison 2.6.9-42.0.3.EL #1 Fri Oct 6 05:59:54 CDT 2006 i686 i686 i386 GNU/Linux gcc -v Reading specs from /usr/lib/gcc/i386-redhat-linux/3.4.6/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-java-awt=gtk --host=i386-redhat-linux Thread model: posix gcc version 3.4.6 20060404 (Red Hat 3.4.6-3) openssl version OpenSSL 0.9.7a Feb 19 2003

1 0

setting up HTTPS service?
by joe＠strout.net 13 Nov '06

13 Nov '06

Complete newbie here, so please bear with me. I want to set up HTTPS service on a Mac OS X (10.4.7) machine running a custom web server. I imagine that Stunnel could be made to listen on the standard HTTPS port (443), do the encryption/decryption, and pass the resulting data to/from the HTTP port (80, or a custom port I specify). This is probably very easy, but none of the documentation or examples I found covered this. Has anyone done this? Or if not, can you sketch out how I would go about it? Any gotchas or caveats I should be aware of? Many thanks, - Joe

3 3

resending FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

1 0

stunnel on Windows with pkcs11
by Neil M. 10 Nov '06

10 Nov '06

Can anyone provide more details in how to get this setup working? I've setup stunnel in client mode just fine for normal SSL operations, but now I need to load a client certificate from a token. I've looked at the example in the documentation and changed the paths accordingly, but that doesn't seem to work, stunnel errors out complaining about a DSO. Neil

1 0

FD_SETSIZE and file ulimit
by Arunkumar Arumugam 10 Nov '06

10 Nov '06

Hi Guys - I have a stunnel setup in a linux box kernel 2.4 Advanced sever release 2.1AS (pensacola) . I am trying to increase the number of file descriptors with which stunnel could handle. So I did a ulimit -n 4096 for root and restarted the stunnel process. Now in the stunnel logs i see, ..... FD_SETSIZE=1024, file ulimit=4096- > 500 clients allowed. I dont completely understand the relation between FD_SETSIZE and file ulimit. I also read that a single stunnel connection might use around 2 or 3 file descriptors. So what is the cap on the number of file descriptors used by stunnel. To make it use , around 4096 file descriptors should i recompile the stunnel again with FD_SETSIZE set to 4096.? -- ARUN ARUMUGAM Galbraith's Law of Human Nature: Faced with the choice between changing ones' mind and proving that there is no need to do so, almost everybody gets busy on the proof.

2 1

stunnel 4.16 wrapped around an ldap server causing very slow binds
by Mark McCoy 05 Nov '06

05 Nov '06

Hey all, I have an instance of stunnel 4.16 on Solaris 10 that I am trying to use to wrap Sun Directory Server LDAP traffic in SSL. LDAP 'binds' take over 2 minutes to complete using stunnel, but only a split second (as they should) when using an SSH tunnel. I have disabled tcpwrappers per the stunnel FAQ with no results, and tried settting delay = "yes" and "no", with no differences in the results. An interesting thing is that if I try to bind using the wrong password, the "Invalid Credentials" error returns immediately. Using the correct password, the bind hangs for over 2 minutes. Any ideas on what to look for? ------------- Output of stunnel -version: stunnel 4.16 on sparc-sun-solaris2.10 with OpenSSL 0.9.8c 05 Sep 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/stunnel/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -------------- -- Mark McCoy -- Professional Unix geek Here in America we are descended in blood and in spirit from revolutionists and rebels - men and women who dared to dissent from accepted doctrine. As their heirs, may we never confuse honest dissent with disloyal subversion. -- Dwight D. Eisenhower

2 1

newbie sendmail + smtp question
by Fred nietzsche 03 Nov '06

03 Nov '06

My ISP requires all my mail to go to mail.myISP.net via SSL to port 465. I have sendmail compiled with STARTTLS, configured authinfo and I've set up sendmail's smarthost to send everything to mail.myISP.net I run stunnel like this. stunnel /etc/stunnel/stunnel.conf -c -d 25 -r mail.myISP.net:465 There are no errors in the log. I can see stunnel listening on 25 with netstat. When I try to send mail I get: bash-3.00# sendmail -v sc00b123(a)yahoo.com <test sc00b123(a)yahoo.com... Connecting to [127.0.0.1] via relay... Which just hangs for ever. My stunnel.conf looks like: cert = /etc/stunnel/mail.pem chroot = /var/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [smtp] accept = 25 connect = 465 Thanks for any help, hints, etc.. --------------------------------- Low, Low, Low Rates! Check out Yahoo! Messenger's cheap PC-to-Phone call rates.

1 0

stunnel[2840]: Error binding pop3s to 0.0.0.0:995
by fxper 02 Nov '06

02 Nov '06

I'm trying to use stunnel on a redhat machine to securely check email, via xinetd via pop3d. My /etc/xinetd.d/pop3s looks like this: service pop3s { socket_type = stream wait = no user = root server = /usr/sbin/stunnel log_on_success += USERID log_on_failure += USERID disable = no } And netstat just shows xinetd on 995: netstat -apn|grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 2797/xinetd When I try to check mail with my client hitting port 995, I get this in /var/log/secure using debug level 7: Nov 1 16:17:24 myhostname xinetd[2797]: START: pop3s pid=2840 from=x.x.x.x Nov 1 16:17:54 myhostname stunnel[2840]: stunnel 4.04 on i386-redhat-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 Nov 1 16:17:54 myhostname stunnel[2840]: Snagged 64 random bytes from /dev/urandom Nov 1 16:17:54 myhostname stunnel[2840]: RAND_status claims sufficient entropy for the PRNG Nov 1 16:17:54 myhostname stunnel[2840]: PRNG seeded successfully Nov 1 16:17:54 myhostname stunnel[2840]: Certificate: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: Key file: /usr/share/ssl/certs/stunnel.pem Nov 1 16:17:54 myhostname stunnel[2840]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed Nov 1 16:17:54 myhostname stunnel[2840]: FD 4 in non-blocking mode Nov 1 16:17:54 myhostname stunnel[2840]: SO_REUSEADDR option set on accept socket Nov 1 16:17:54 myhostname stunnel[2840]: Error binding pop3s to 0.0.0.0:995 Nov 1 16:17:54 myhostname stunnel[2840]: bind: Address already in use (98) Any suggestions? Thanks! --------------------------------- Want to start your own business? Learn how on Yahoo! Small Business.

1 0

How to disable SSLv2
by Tommi Nieminen 30 Oct '06

30 Oct '06

I'm using Stunnel 4.18. I would like to disable SSLv2, but allow SSLv3 and TLSv1. Is this currently possible in Stunnel? I've tried two things so far: first I tried to use the option options = SSL_OP_NO_SSLv2 (from "man SSL_CTX_set_options") It didn't work. This is what I got: 2006.10.27 18:32:48 LOG7[6358:3082897088]: Snagged 64 random bytes from /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: Wrote 1024 new random bytes to /root/.rnd 2006.10.27 18:32:48 LOG7[6358:3082897088]: RAND_status claims sufficient entropy for the PRNG 2006.10.27 18:32:48 LOG7[6358:3082897088]: PRNG seeded successfully file /etc/stunnel/stunnel.conf line 18: Illegal SSL option Nothing gets logged, the above is the response to the startup command. The other thing I tried, though I really didn't expect it to work, was replacing the "options" option with sslVersion = SSLv3 TLSv1 This option seems to accept only one version at a time, or alternatively all of them with "all" on the right hand side, so this failed, stunnel didn't start. Any suggestions? The only thing I can think of is that the SSL option SSL_OP_NO_SSLv2 is something that should have been when configuring the OpenSSL installation, and since I have a readily wrapped package, it has not been included there. In that case I could install OpenSSL from the scratch. But before I try that, I thought I would ask if somebody were already familiar with the problem. Tommi Nieminen --------------------------------------------------- Here is the stunnel config file I was using: CAfile = /etc/stunnel/root-cert.pem cert = /etc/stunnel/device-cert.pem key = /etc/stunnel/device-key.pem output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 verify = 1 options = SSL_OP_NO_SSLv2 ;sslVersion = SSLv3 TLSv1

2 2

stunnel patch for extra logging
by Steven Van Acker 29 Oct '06

29 Oct '06

Hi, we use stunnel in server-mode where an SSL enabled client can connect to our stunnel, and then stunnel connects to a non-SSL backend server. The backend server logs incoming connections from stunnel (source IP and port), but stunnel doesn't log the same information. This makes it difficult to match logs between stunnel and the backend. This patch solves exactly this problem. I rewrote the patch so that it can be cleanly applied to any future (and past) version of stunnel. >From the website: "How do I get a patch included into the release versions of Stunnel? Only patches released into the public domain stand a chance of getting into the actual Stunnel source. This means revised BSD patches are likely acceptable. Original BSD and GNU patches are not for example." Since I would like very much that this patch makes it into the next release, I'll release it into the public domain or any other license that makes this possible. kind regards, Steven -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Re: [stunnel-users] Fork Error
by Michal Trojnara 29 Oct '06

29 Oct '06

On Friday 27 October 2006 22:39, John O'Fallon wrote: > I do believe, though, that the problem is due to a change in Stunnel > between version 4.15 and 4.17, since the crash occurs when running > 4.17, but reverting to 4.15 on exactly the same system clears it up. > I have seen this on at least 2 different Mac servers. Please make some tests for me: 1. Try: ./configure --disable-libwrap make clean make make install 2. Check if there are some zombies produced by stunnel. 3. Include your configuration file and the output of "stunnel -version" with your next email. Best regards, Mike

1 0

SMTP & TLS
by Eric B. 27 Oct '06

27 Oct '06

Hi, I've been looking over using stunnel to secure SMTP connections, but am a little confused about how the protocol works. From what I've read, the STARTTLS command is used to allow a client/server to upgrade a connection from plaintext to SSL secured. Further to that, from what I understand, the concept is to allow/use a single port to initiate all connections - ex: port 25. >From what I can tell from stunnel however, is that once stunnel issues the STARTTLS command, if the client doesn't respond in kind, then the connection is terminated. I've tried reading the RFC, but can't seem to find what happens in the case where the client rejects or does not respond to the STARTTLS command. Logicially, I would expect the SMTP connection to continue normally in plaintext. Apparently, this is not how stunnel works. Can someone please help fill in the blanks for me please? What is supposed to happen if the client refuses the STARTTLS request from the server? If the connection is supposed to die, why bother with the STARTTLS request at all, and not just impose the SSL encrypted tunnel from the very beginning (as per the old SSMTP specs)? Thanks, Eric

1 0

Fork Error
by John O'Fallon 27 Oct '06

27 Oct '06

Since upgrading to Stunnel 4.17, I occasionally get the following error: 2006.10.18 23:08:45 LOG3[7007:25232896]: fork: Resource temporarily unavailable (35) 2006.10.18 23:08:45 LOG5[7007:25232896]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The problem doesn't occur right away, but after some number of hits on the server. Reverting to Stunnel 4.15 corrects the problem. This is an OS X 10.4 Mac. I haven't confirmed the problem with 4.18, because the release notes indicate mainly changes relevant to Win32. Has any one else seen the problem? Michal, any thoughts? TIA, John

2 1

Stunnel hangs on big flows of data
by Dario Mariani 27 Oct '06

27 Oct '06

Hi... I'm deploying stunnel on some servers. I did some tests, and i never had problems. For example, i tried 5k parallel connections, and i didn't have any problem. But, i have problems when a small number of connections wants to transfer big chunks of information; the connection hangs. This is a snippet of logs: Server side: 2006.10.20 16:00:58 LOG7[20302:1]: oracle11521 accepted FD=226 from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 started 2006.10.20 16:00:58 LOG7[20302:200]: FD 226 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on local socket 2006.10.20 16:00:58 LOG5[20302:200]: oracle11521 connected from 192.168.22.10:39721 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): before/ accept initialization 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read client hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write server hello A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 write finished A 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 flush data 2006.10.20 16:00:58 LOG7[20302:200]: SSL state (accept): SSLv3 read finished A 2006.10.20 16:00:58 LOG7[20302:200]: 3 items in the session cache 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects (SSL_connect ()) 2006.10.20 16:00:58 LOG7[20302:200]: 0 client connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 client renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 199 server connects (SSL_accept()) 2006.10.20 16:00:58 LOG7[20302:200]: 194 server connects that finished 2006.10.20 16:00:58 LOG7[20302:200]: 0 server renegotiations requested 2006.10.20 16:00:58 LOG7[20302:200]: 173 session cache hits 2006.10.20 16:00:58 LOG7[20302:200]: 0 session cache misses 2006.10.20 16:00:58 LOG7[20302:200]: 18 session cache timeouts 2006.10.20 16:00:58 LOG6[20302:200]: SSL accepted: previous session reused 2006.10.20 16:00:58 LOG7[20302:200]: FD 227 in non-blocking mode 2006.10.20 16:00:58 LOG7[20302:200]: oracle11521 connecting 192.168.22.13:1521 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: waiting 10 seconds 2006.10.20 16:00:58 LOG7[20302:200]: connect_wait: connected 2006.10.20 16:00:58 LOG7[20302:200]: Remote FD=227 initialized 2006.10.20 16:00:58 LOG7[20302:200]: TCP_NODELAY option set on remote socket 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying 2006.10.20 16:00:58 LOG7[20302:75]: SSL_read returned WANT_READ: retrying client side: 2006.10.20 16:16:01 LOG6[12415:91]: SSL connected: new session negotiated 2006.10.20 16:16:01 LOG6[12415:91]: Negotiated ciphers: DES-CBC3- SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2006.10.20 16:16:01 LOG7[12415:91]: Socket closed on read 2006.10.20 16:16:01 LOG7[12415:91]: SSL write shutdown 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (write): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL_shutdown retrying 2006.10.20 16:16:01 LOG7[12415:91]: SSL doesn't need to read or write 2006.10.20 16:16:01 LOG7[12415:91]: SSL alert (read): warning: close notify 2006.10.20 16:16:01 LOG7[12415:91]: SSL closed on SSL_read 2006.10.20 16:16:01 LOG7[12415:91]: Socket write shutdown 2006.10.20 16:16:01 LOG5[12415:91]: Connection closed: 3663 bytes sent to SSL, 5239 bytes sent to socket 2006.10.20 16:16:01 LOG7[12415:91]: oracle11521 finished (3 left) The timings are shifted, i don't know if the delta of time is related to a misconfiguration of clock on the machines, or are snippets taken from different events... i don't have direct access to the machines. I tried to make a test (client and server on the same machine) client: nc localhost 10001 >>/dev/null stunnel accept on 10001 and connect to localhost:11521 on the server side: stunnel accept on 11521 and connect on 1521 cat 230megsfile | nc -l -p 1521 & 2>&1 >>/dev/null so, when the nc on client side connects, the server starts the cat. It did complete correctly within a pair of minutes on an ibook 64 1.33 1g ram, but with LOADS of want_read and want_write errors on both sides of stunnel. The server and client are working on "big iron", i mean some superdome hardware with 30-40 cpu on both sides, and with an estimated traffic of 10gig/day And, important... the version of the stunnel instances is 4.15 Can you help me? Bye, dario.

2 4

Fwd: [stunnel-users] Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

I forgot to send this to the entire group. My server program was listening on the wrong port. :-) Thanks, - Jeremiah ---------- Forwarded message ---------- From: Jeremiah Martell <inlovewithgod(a)gmail.com> Date: Oct 25, 2006 8:59 AM Subject: Re: [stunnel-users] Stunnel client not sending data To: Carter Browne <cbrowne(a)cbcs-usa.com> HA! Such a simple thing, but yes, that was the problem. I had the wrong port. :-) Thanks, - Jeremiah On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > Jeremiah, > > I set the debug level on a stunnel configuration to 7 to understand better where you are failing. You have established > good connection to stunnel, but stunnel cannot get to 127.0.0.1:10000. So is your application listening on > 127.0.0.1:10000? Have you tried running netstat -an to establish that there is a process listening to the port? > > Carter > > Jeremiah Martell wrote: > > Carter, > > > > You're right. That was a typo error on my part. My config says 1.2.3.70. > > > > Anything other ideas? > > > > Thanks, > > - Jeremiah > > > > On 10/25/06, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > >> On the server side, I think you should be receiving on 1.2.3.70 (since > >> that is where you are sending the data). > >> > >> Carter > >> > >> Jeremiah Martell wrote: > >> > Hello, > >> > > >> > I have a program that opens up a connection to port 10000 of a server > >> > and sends it some data. It works normally. I'm trying to "stunnel" > >> > both ends. > >> > > >> > In my program I create a socket, connect to local port 7033, send my > >> > data, and close the socket. I verified that every function call > >> > returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, > >> > connect, and send). > >> > > >> >> From what the logs show below, it seems that server stunnel gets the > >> > connection from the client stunnel, they successfully negotiate the > >> > SSL stuff, then the client stunnel waits for any data to proxy to the > >> > server stunnel. The server stunnel is waiting too, and after 10 > >> > seconds of no data, it closes the socket. > >> > > >> > For some reason the client stunnel is not getting my data and > >> > therefore doesn't forward anything over to the server stunnel. I'm not > >> > sure why this is happening, because my program works normally and I've > >> > verified that everything returned success. > >> > > >> > Any ideas? > >> > > >> > - Jeremiah > >> > > >> > ----------------------------- > >> > > >> > ON CLIENT (1.2.3.60) > >> > > >> > Linux > >> > stunnel 4.16 > >> > OpenSSL 0.9.7c > >> > > >> > stunnel.conf is... > >> > pid = > >> > client = yes > >> > > >> > [7033] > >> > accept = 127.0.0.1:7033 > >> > connect = 1.2.3.70:7033 > >> > > >> > ----------------------------- > >> > > >> > ON SERVER (1.2.3.70) > >> > > >> > Windows > >> > stunnel 4.16 windows binary installer (Aug 31 2006) > >> > > >> > stunnel.conf is... > >> > > >> > cert = stunnel.pem > >> > socket = l:TCP_NODELAY=1 > >> > socket = r:TCP_NODELAY=1 > >> > debug = 7 > >> > > >> > [7033] > >> > accept = 1.2.3.60:7033 > >> > connect = 127.0.0.1:10000 > >> > > >> > ----------------------------- > >> > > >> > On client I see this debug... > >> > > >> > Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from > >> > 127.0.0.1:10251 > >> > Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by > >> > peer (104) > >> > Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes > >> > sent to SSL, 0 bytes send to socket > >> > > >> > ----------------------------- > >> > > >> > On server I see this debug... > >> > > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from > >> > 1.2.3.60:10252 > >> > 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread > >> > 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local > >> socket > >> > 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept > >> > initialization > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server hello A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > certificate A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > server done A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > client key exchange A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > change cipher spec A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write > >> > finished A > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush > >> data > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects > >> (SSL_connect()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects > >> (SSL_accept()) > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations > >> requested > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session > >> negotiated > >> > 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA > >> > SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 > >> > 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds > >> > 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout > >> > 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to > >> > SSL, 0 bytes sent to socket > >> > 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left) > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)mirt.net > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > >> > >> > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Trying to redirect with stunnel - seems to hang
by Len DiMaggio 26 Oct '06

26 Oct '06

'Evening everyone, I'm wondering if anyone has already seen a problem like this. Background - I'm trying to use stunnel to act as an SSL server and redirect connections so that I can use the JMeter script recorder to build automated tests for an app's web GUI. (The recorder does not support SSL.) The software versions are: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 I'm able to set up the redirection, and everything in the stunnel log looks OK - and, this is just making the connection manually - without JMeter - but trying to access the target app just hangs in the browser with a "connecting to..." status message. Here's the stunnel config file that I'm using - the log is attached. client=yes output=/tmp/stunnel.log debug=debug [8084] accept=hostname:8079 connect=hostname:8084 Interestingly - when I kill the stunnel process, the browser displays (most of) the target app's top level page. Thanks in advance, Len DiMaggio ldimaggi(a)redhat.com The stunnel log sez: 2006.10.24 04:58:33 LOG5[5869:3086362304]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 2006.10.24 04:58:33 LOG5[5869:3086362304]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2006.10.24 04:58:33 LOG6[5869:3086362304]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.10.24 04:58:33 LOG6[5869:3086362304]: poll() used - no FD_SETSIZE limit for file descriptors 2006.10.24 04:58:33 LOG5[5869:3086362304]: 500 clients allowed 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 4 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 5 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: FD 6 in non-blocking mode 2006.10.24 04:58:33 LOG7[5869:3086362304]: SO_REUSEADDR option set on accept socket 2006.10.24 04:58:33 LOG7[5869:3086362304]: 8084 bound to 10.15.49.274:8079 2006.10.24 04:58:33 LOG7[5870:3086362304]: Created pid file /var/run/stunnel.pid 2006.10.24 04:58:52 LOG7[5870:3086362304]: 8084 accepted FD=7 from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 started 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 7 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 9 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086362304]: Cleaning up the signal pipe 2006.10.24 04:58:52 LOG6[5870:3086362304]: Child process 5874 finished with code 0 2006.10.24 04:58:52 LOG7[5870:3086359440]: Connection from 172.16.83.99:58417 permitted by libwrap 2006.10.24 04:58:52 LOG5[5870:3086359440]: 8084 connected from 172.16.83.99:58417 2006.10.24 04:58:52 LOG7[5870:3086359440]: FD 8 in non-blocking mode 2006.10.24 04:58:52 LOG7[5870:3086359440]: 8084 connecting 10.15.49.274:8084 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: waiting 10 seconds 2006.10.24 04:58:52 LOG7[5870:3086359440]: connect_wait: connected 2006.10.24 04:58:52 LOG7[5870:3086359440]: Remote FD=8 initialized 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): before/connect initialization 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server hello A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server certificate A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read server done A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write client key exchange A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write change cipher spec A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 write finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 flush data 2006.10.24 04:58:52 LOG7[5870:3086359440]: SSL state (connect): SSLv3 read finished A 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 items in the session cache 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects (SSL_connect()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 1 client connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 client renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects (SSL_accept()) 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server connects that finished 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 server renegotiations requested 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache hits 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache misses 2006.10.24 04:58:52 LOG7[5870:3086359440]: 0 session cache timeouts 2006.10.24 04:58:52 LOG6[5870:3086359440]: SSL connected: new session negotiated 2006.10.24 04:58:52 LOG6[5870:3086359440]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 -- Len DiMaggio (ldimaggi(a)redhat.com) Red Hat USA 10 Technology Park Drive Westford, MA 01886 tel: 978.392.3179 cell: 617.872.3673 http://www.redhat.com

3 2

status of www.stunnel.org
by Steven Van Acker 26 Oct '06

26 Oct '06

Hi, I noticed how the website http://www.stunnel.org is out of sync with the latest releases of stunnel. Are there plans to update this site ? And if not, would it be possible to redirect its visitors to http://stunnel.mirt.net/ automatically ? kind regards, -- Steven Van Acker -- My amazon wishlist: http://www.amazon.com/gp/registry/1DB4XNEIEQBPB

2 1

Stunnel client not sending data
by Jeremiah Martell 26 Oct '06

26 Oct '06

Hello, I have a program that opens up a connection to port 10000 of a server and sends it some data. It works normally. I'm trying to "stunnel" both ends. In my program I create a socket, connect to local port 7033, send my data, and close the socket. I verified that every function call returns success (socket, setsockopt (for TCP_NODELAY), gethostbyname, connect, and send). >From what the logs show below, it seems that server stunnel gets the connection from the client stunnel, they successfully negotiate the SSL stuff, then the client stunnel waits for any data to proxy to the server stunnel. The server stunnel is waiting too, and after 10 seconds of no data, it closes the socket. For some reason the client stunnel is not getting my data and therefore doesn't forward anything over to the server stunnel. I'm not sure why this is happening, because my program works normally and I've verified that everything returned success. Any ideas? - Jeremiah ----------------------------- ON CLIENT (1.2.3.60) Linux stunnel 4.16 OpenSSL 0.9.7c stunnel.conf is... pid = client = yes [7033] accept = 127.0.0.1:7033 connect = 1.2.3.70:7033 ----------------------------- ON SERVER (1.2.3.70) Windows stunnel 4.16 windows binary installer (Aug 31 2006) stunnel.conf is... cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 [7033] accept = 1.2.3.60:7033 connect = 127.0.0.1:10000 ----------------------------- On client I see this debug... Oct 24 14:38:22 stunnel: LOG5[2892:258]: 7033 connected from 127.0.0.1:10251 Oct 24 14:38:32 stunnel: LOG3[2892:258]: SSL_read: Connection reset by peer (104) Oct 24 14:38:32 stunnel: LOG5[2892:258]: Connection reset: 56 bytes sent to SSL, 0 bytes send to socket ----------------------------- On server I see this debug... 2006.10.24 14:43:08 LOG7[2596:4068]: 7033 accepted FD=196 from 1.2.3.60:10252 2006.10.24 14:43:08 LOG7[2596:4068]: Creating a new thread 2006.10.24 14:43:09 LOG7[2596:4068]: New thread created 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 started 2006.10.24 14:43:09 LOG7[2596:2372]: FD 196 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: TCP_NODELAY option set on local socket 2006.10.24 14:43:09 LOG5[2596:2372]: 7033 connected from 1.2.3.60:10252 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): before/accept initialization 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server hello A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write certificate A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write server done A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read client key exchange A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 read finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 write finished A 2006.10.24 14:43:09 LOG7[2596:2372]: SSL state (accept): SSLv3 flush data 2006.10.24 14:43:09 LOG7[2596:2372]: 3 items in the session cache 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects (SSL_connect()) 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 client renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects (SSL_accept()) 2006.10.24 14:43:09 LOG7[2596:2372]: 5 server connects that finished 2006.10.24 14:43:09 LOG7[2596:2372]: 0 server renegotiations requested 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache hits 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache misses 2006.10.24 14:43:09 LOG7[2596:2372]: 1 session cache timeouts 2006.10.24 14:43:09 LOG6[2596:2372]: SSL accepted: new session negotiated 2006.10.24 14:43:09 LOG6[2596:2372]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.24 14:43:09 LOG7[2596:2372]: FD 180 in non-blocking mode 2006.10.24 14:43:09 LOG7[2596:2372]: 7033 connecting 127.0.0.1:10000 2006.10.24 14:43:09 LOG7[2596:2372]: connect_wait: waiting 10 seconds 2006.10.24 14:43:19 LOG6[2596:2372]: connect_wait: s_poll_wait timeout 2006.10.24 14:43:19 LOG5[2596:2372]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.24 14:43:19 LOG7[2596:2372]: 7033 finished (0 left)

3 4

[OT] Questions about OpenSSL
by Gonzalo Diethelm 25 Oct '06

25 Oct '06

Hello everyone, I have a slightly off-topic question but one I think stunnel's developers are in a good position to assist me with. I need to implement what amounts to an embedded web server for a process that will be deployed on a "hostile" server (Win32), meaning that I don't want the people in that server to mess around with either the process or the network traffic to/from the process. The goal is to deploy a binary and a set of DLLs to the hostile server (no configuration files). To this effect, I have found a couple of usable HTTP server libraries, and I have implemented the functionality I need over clean HTTP. Now, I would like to use SSL to encrypt the data coming and going to my process; alas, I have not found any open source HTTP library that also supports HTTPS. Therefore, I have come to the conclusion that I will have to integrate OpenSSL into one of the HTTP libraries myself. The first question is: how difficult is it to integrate OpenSSL in "server mode" into an application? I tried taking a peek at Apache's mod_ssl, but being unfamiliar with Apache's internals, I was completely lost. Then it occurred to me that stunnel must do something similar to what I need, and indeed I could follow the code in stunnel to a point; before going any further, I wanted to first hear comments, opinions and hints from the developers. It also occurred to me that I could do what I need if stunnel offered some kind of "in process" handling of requests: instead of forwarding to a certain host:port the requests it gets, maybe stunnel itself could be configured to process the requests somehow, generate the responses and send them back; for instance, what I need to do is basically query a MySQL DB and send some records back. I am pretty sure this is not supported in stunnel today, but if it is something that anyone (besides me) sees as useful, I could volunteer to do at least part of the development. Alternatively, please feel free to educate me on why this is a moronic idea... In any case, thanks for a great product and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Connection problems and TCP frame checksum errors
by Tommi Nieminen 23 Oct '06

23 Oct '06

I have the following kind of test environment: SSL clients call a public ip address from which the calls are forwarded to a linux server with Stunnel. The linux server is in a private network. Stunnel decrypts the data and sends it forward. I have been testing this with a browser, monitoring the traffic on the server to see that Stunnel forwards the calls. Some strange things happen there that I can't explain. First of all: sometimes the calls go through the server as expected, sometimes the server doesn't respond in any way to the client. If I have two terminal windows open, one with tcpdump and another with tail -f stunnel.log - nothing comes into the log in spite of the incoming connections attempts. Then on other occasions when the calls come to the server, it forwards them beautifully to the address and port set in the configuration file. Does anyone have any clue, what this could be due to? I haven't been able to explain why it sometimes works and sometimes doesn't. Another thing that bothers me is, that sometimes there are TCP frames with incorrect checksum. I've monitored with Ethereal and tcpdump. Both show incorrect frames, and they are always from the stunnel-end of the connection. What could be the cause of those broken frames? Tommi Nieminen -------------------------------------------------------- My stunnel.conf looks like this: (any constructive criticism would be welcome :-)) CAfile = /home/tommi/cert/7/demoCA/cacert.pem cert = /home/tommi/cert/7/newcert.pem key = /home/tommi/cert/7/newkey.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel/stunnel.log pid = /var/run/stunnel/stunnel.pid debug = 7 client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 -------------------------------------------------------- A succesful connection from stunnel.log: 2006.10.09 18:01:43 LOG7[11889:3083744960]: https accepted FD=7 from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: https started 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 7 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on local socket 2006.10.09 18:01:43 LOG5[11889:3083742128]: https connected from 131.177.254.92:2689 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): before/accept initialization 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server hello A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write certificate A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write server done A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read client key exchange A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 read finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write change cipher spec A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 write finished A 2006.10.09 18:01:43 LOG7[11889:3083742128]: SSL state (accept): SSLv3 flush data 2006.10.09 18:01:43 LOG7[11889:3083742128]: 2 items in the session cache 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects (SSL_connect()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 client renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 8 server connects (SSL_accept()) 2006.10.09 18:01:43 LOG7[11889:3083742128]: 7 server connects that finished 2006.10.09 18:01:43 LOG7[11889:3083742128]: 0 server renegotiations requested 2006.10.09 18:01:43 LOG7[11889:3083742128]: 4 session cache hits 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache misses 2006.10.09 18:01:43 LOG7[11889:3083742128]: 1 session cache timeouts 2006.10.09 18:01:43 LOG6[11889:3083742128]: SSL accepted: new session negotiated 2006.10.09 18:01:43 LOG6[11889:3083742128]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.10.09 18:01:43 LOG7[11889:3083742128]: FD 8 in non-blocking mode 2006.10.09 18:01:43 LOG7[11889:3083742128]: https connecting 192.168.10.17:5010 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: waiting 10 seconds 2006.10.09 18:01:43 LOG7[11889:3083742128]: connect_wait: connected 2006.10.09 18:01:43 LOG7[11889:3083742128]: Remote FD=8 initialized 2006.10.09 18:01:43 LOG7[11889:3083742128]: TCP_NODELAY option set on remote socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: Socket closed on read 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL write shutdown 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL alert (write): warning: close notify 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL_shutdown retrying 2006.10.09 18:02:45 LOG7[11889:3083742128]: SSL doesn't need to read or write 2006.10.09 18:02:45 LOG6[11889:3083742128]: s_poll_wait timeout: connection close 2006.10.09 18:02:45 LOG5[11889:3083742128]: Connection closed: 0 bytes sent to SSL, 405 bytes sent to socket 2006.10.09 18:02:45 LOG7[11889:3083742128]: https finished (0 left) (and the failed connections leave also no mark in the log, but tcpdump sees the attempts on the server) -------------------------------------------------------- A sample of tcpdump's output with incorrect checksum: 18:02:45.150656 IP (tos 0x0, ttl 64, id 11218, offset 0, flags [DF], proto: TCP (6), length: 77) 192.168.20.18.https > 131.177.254.92.2689: P, cksum 0x5708 (incorrect (-> 0xf1bf), 1035:1072(37) ack 756 win 7504

2 6

Thank you very much for all your donations
by Michal Trojnara 21 Oct '06

21 Oct '06

Dear Users, I want you to know how much grateful I am for all your donations. Thank you very much. Some day stunnel may be full-time job. 8-) Even now sponsored features make a substantial addition to my budget. BTW: I have updated currency to USD. I hope it's more convenient. http://stunnel.mirt.net/ Best regards, Mike

1 0

error 1703, service already exists.
by Joop Blokker 20 Oct '06

20 Oct '06

Hello, I'm using sTunnel v4.18 under Windows XP as a client. I start the serv= ice with sTunnel -install -quiet If, for any reason, the same command is given again then the error mes= sage "Create service; error 1703; the specified service already exists= " pops up. In that case the -quiet parameter does not work. I do not w= ant to see that error message; if the service is running then it's oka= y. Q:. How can I suppress that error message? If that is not an option, h= ow can I detect that the sTunnel service is installed already? I'm programming in PowerBASIC - I know how to detect sTunnel once it h= as started with -start -quiet Thanks in advance for any idea! Joop. +++ Too far East is West. - Proverb (English) +++

2 1

stunnel client without any configuration
by Thomas Stegbauer 18 Oct '06

18 Oct '06

hi ml, i searched the list about an idea, but didn't find the complete answer, so i would ask: i am thinking about a https website (with logon), where you can download a completly preconfigured package (java-applet?) which checks HTTP_PROXY on unix and the msie registry settings on windows and connect a local port to a remote running stunnel, listening on port 443 (the stunnel ist running on a different ip). currently there are imho two points, which need solved: 1.) there is no proxy support, without a patch 2.) it is currently not possible to download a preconfigured package are there some thoughts? greetings thomas -- # Thomas Stegbauer # https://keyserver1.pgp.com/vkd/DownloadKey.event?keyid=0x9A3F1866FC68E91D # Key fingerprint = 5A2D FEDC 8A50 F1BB 25FB 967B 9A3F 1866 FC68 E91D

2 1

Infinite client timeout
by Dario Mariani 18 Oct '06

18 Oct '06

Hi all, i'm a new user :) I'm deploying stunnel into a big enterprise, so i have met a lot of interesting details about Stunnel :) I have a little problem now: a Stunnel channel connecting BEA Weblogic -> Oracle listener. BEA has the BIG problem of _completely locking_ when the connection goes down: when the connection comes up again, bea doesn't work. This is not an issue, because there's a keepalive feature that can be activated in BEA. In a case, we _cannot_ activate the keepalive, so we must try to keep the BEA -> stunnel client conection open indefinitely. I think this must apply to the other parts of the connection, but i'm not sure (if the bea -> client connection remains active, the client then can renegotiate the connection without bea noticing it? and the server -> oracle connection?) Ok, i'm a little confused here :) Can you help me with this issue? Bye, dario.

1 0

New feature - PayPal donations
by Michal Trojnara 16 Oct '06

16 Oct '06

Dear Users, Since PayPal finally decided to provide full support for users in Poland I've added a donation button on the web page. http://stunnel.mirt.net/ I really appreciate each donation. 8-) Best regards, Mike

1 0

"Peer suddenly disconnected" after upgrade to 4.18
by Asarian 14 Oct '06

14 Oct '06

Hello, I'm a long time user of stunnel. Yesterday I finally upgraded to stunnel 4.18. Can't get it to work anymore, though. :( Here is the relevant part of my config: ----------------------- cert = /etc/stunnel.pem key = /etc/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH sslVersion = SSLv2 setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none [pop3s] accept = 995 exec = /usr/local/libexec/inet-qpopper execargs = inet-qpopper -s transparent = yes [imaps] accept = 993 exec = /usr/local/libexec/imapd execargs = imapd transparent = yes ----------------------- With the exception of a few keyword changes, this is the config I've always used. But I always get these errors now: Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.79.4:2576 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: pop3s connected from 192.168.1.4:2579 Oct 14 00:57:40 asarian-host stunnel: LOG3[49682:134621184]: SSL_accept: Peer suddenly disconnected Oct 14 00:57:40 asarian-host stunnel: LOG5[49682:134621184]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket The cert and key are good (I use em for Apache, too). I also tried SSLv3, but got this error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number But I like to get it working with SSLv2 first; then I'll worry about the other thing later. :) I hope someone can tell me what I'm doing wrong. Thanks, - Mark

1 0

SegFault with stunnel
by Beyerle, Christian 12 Oct '06

12 Oct '06

Hello Everyone, I try to encrypt a Mysql-Connection between two host which run Suse Linux 10.1. On the Server runs a mysql database, on the client runs barnyard (a plugin for snort) which should write into the mysql database. I installed stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 on both servers. The Configuration file on the Server (mysql) looks like: client = no debug = 7777777 output = /var/log/stunnel.log [mysqls] accept = 10439 connect = 127.0.0.1:3306 Stunnel seems to run well: lsof -i -n | grep stunnel stunnel 25330 stunnel 6u IPv4 371490 TCP *:10439 (LISTEN) On the client: [mysqls] client = yes accept = 127.0.0.1:3306 connect = 172.16.1.80:10439 Stunnel seems to run as well as on the server: stunnel 16634 stunnel 6u IPv4 22487 TCP 127.0.0.1:mysql (LISTEN) If i start barnyard that should connect to port 3306, barnyard cannot open the port and quits. I looked in my syslog and found the following entry: Oct 12 14:10:28 CLIENT kernel: stunnel[10991]: segfault at 0000000055697fb0 rip 000055555555b793 rsp 00005555556b0520 error 4 Oct 12 14:10:28 CLIENT barnyard[10997]: FATAL ERROR: Failed to connect to database snort:[email protected]/sensors: Lost connection to MySQL server during query Oct 12 14:10:28 CLIENT barnyard[10997]: Exiting I find no log of stunnel which help me to understand the reason of the crash. After this stunnel not too seem runnign anymore on the port: lsof -i -n | grep stunnel (no output) Does anybody have an idea??? Thank you for the help, -- Chris

1 0

[stunnel-users]Plan for new authorisation method in Stunnel
by Thomas Thiele 11 Oct '06

11 Oct '06

Hello Stunnel Users, I am planning to develop a new authorisation method for Stunnel which I need for work. This method will be an addition to the existing methods for checking certificates. The idea is to use the subject names and the alternative names of the certificates to allow or drop connections. The subject and alternative names of the machines/clients that are allowed to connect to the server will be written into the Stunnel config. While checking the certificates, the subject and alternative names from the Stunnel config will be compared with the subject and alternative names in the certirficate from the connection request. If one of the names from the Stunnel config matches with the names from the certificate then the connection will be allowed. This is the basic idea of my project. Is anyone already working on something like that or do you have any ideas or suggestions for me? Best Regards, Thomas Thiele -- GMX DSL-Flatrate 0,- Euro* - Überall, wo DSL verfügbar ist! NEU: Jetzt bis zu 16.000 kBit/s! http://www.gmx.net/de/go/dsl

2 1

libstunnel.so
by Andrew Schulman 05 Oct '06

05 Oct '06

The Debian stunnel (actually stunnel4) package includes /usr/lib/libstunnel.so. I have two questions about this file: (1) What is its purpose? ldd shows that /usr/bin/stunnel doesn't depend on it. So is this the shared library referred to in stunnel(1), under the 'transparent' option? The man page says that to use 'transparent' one has to LD_PRELOAD env.so, but I don't find any env.so. I see that env.c is used in building libstunnel.a, so I'm guessing that the man page meant to say libstunnel.so instead of env.so. (2) How does one build it? configure includes a --with-shared-libs option, but even when that's enabled I don't get a libstunnel.so when I build. And I can't find any make targets for any .so files. Yet Debian includes this file. Thanks, Andrew.

1 0

Configure can't find openssl in Ubuntu
by Tommi Nieminen 04 Oct '06

04 Oct '06

Hello, I have an Ubuntu 6.06.1 (Dapper) where I'm trying to install Stunnel. First I tried to install Stunnel using Ubuntu's package manager (apt-get install stunnel4). The installation went very smoothly but the fact that stunnel didn't recognize the -V switch left me with an uneasy feeling that something else might be lacking, too. The Ubuntu package in question contains Stunnel 4.14. Stunnel 3.26, installed from another package, does recognize the -V switch. So then I tried several times installing stunnel from source. A few obstacles I managed to overcome, but now that the configure script stops telling that it can't find SSL directory checking for SSL directory... Not found Couldn't find your SSL library installation dir Use --with-ssl option to fix this problem I'm out of resources. The script seems to check the existence of ssl.h file: checkssldir() { : if test -f "$1/include/openssl/ssl.h" Despite the fact that I have OpenSSL 0.9.8a on my machine, I don't have ssl.h file anywhere, I checked that with find. I tried installing Linux headers, but that didn't help (well I didn't expect it to help, but I couldn't think of anything). Is there some package I should get, that doesn't come with the openssl package or how should I solve this problem? Any ideas? Another problem that I had when I was experimenting with Stunnel 3.26 was the fact, that I couldn't start it up. It kept asking for the -r or -l switch. What I want to do with Stunnel is to decrypt the traffic coming in on one interface and then forward it to another machine through another interface. I tried several different configuration files, this is one of them (without indentations): cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 debug = 7 output = stunnel.log client = no [https] accept = 443 connect = 192.168.10.17:5010 TIMEOUTclose = 0 I didn't get any debug information and -f switch didn't give anything more. I tried the Windows version (4.18) on another pc and it seemed to do exactly what I wanted. (the config file may have been slightly different, at least no debug was set. I really would like to get this working on a Linux box, too. Tommi Nieminen

3 3