- stunnel-users - stunnel.org

Convert to SSL
by Bob 04 Oct '06

04 Oct '06

Hello all, I have been looking online at the examples but can't seem to quite figure out how to do this. We are currently using stunnel to receive SSL message and redirect them as regular messages but now I need to go the other way first. Is it possible to setup stunnel to receive an non-SSL messages and redirect it as an SSL message? and can this be done in the current config file or do I have to run 2 stunnel daemons? Also, the new one has to validate certificates. -- _______________________________________________________________________ Thanks, Bob (bobif(a)adelphia.net) YahooIM: bobifx AOLIM: bobifmd ICQ: 111083556

1 0

"SSL3_GET_RECORD:wrong version number" error
by James Brown 04 Oct '06

04 Oct '06

I am having problems connecting to stunnel and was hoping someone could help me. When starting stunnel and then trying to send an SSL-encrypted email through it I get: $ sudo /usr/local/sbin/stunnel /sw/etc/stunnel/stunnel.conf -D 465 -r 25 2006.10.04 11:03:28 LOG7[29230:2684415368]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.10.04 11:03:28 LOG7[29230:2684415368]: RAND_status claims sufficient entropy for the PRNG 2006.10.04 11:03:28 LOG7[29230:2684415368]: PRNG seeded successfully 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate: /Users/ jlbrown/%1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Certificate loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: Key file: /Users/jlbrown/% 1.pem 2006.10.04 11:03:28 LOG7[29230:2684415368]: Private key loaded 2006.10.04 11:03:28 LOG7[29230:2684415368]: SSL context initialized for service ssmtp 2006.10.04 11:03:28 LOG5[29230:2684415368]: stunnel 4.18 on powerpc- apple-darwin8.8.0 with OpenSSL 0.9.7i 14 Oct 2005 2006.10.04 11:03:28 LOG5[29230:2684415368]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.10.04 11:03:28 LOG6[29230:2684415368]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.10.04 11:03:28 LOG6[29230:2684415368]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.10.04 11:03:28 LOG5[29230:2684415368]: 125 clients allowed 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 6 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 7 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: FD 8 in non-blocking mode 2006.10.04 11:03:28 LOG7[29230:2684415368]: SO_REUSEADDR option set on accept socket 2006.10.04 11:03:28 LOG7[29230:2684415368]: ssmtp bound to 0.0.0.0:465 James-Browns-Computer-2:~/stunnel-4.18 jlbrown$ 2006.10.04 11:03:28 LOG7[29231:2684415368]: Created pid file /usr/local/var/run/stunnel/ stunnel.pid 2006.10.04 11:08:08 LOG7[29231:2684415368]: ssmtp accepted FD=9 from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp started 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 9 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on local socket 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 11 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: Connection from 127.0.0.1:64235 permitted by libwrap 2006.10.04 11:08:08 LOG5[29231:25188864]: ssmtp connected from 127.0.0.1:64235 2006.10.04 11:08:08 LOG7[29231:2684415368]: Cleaning up the signal pipe 2006.10.04 11:08:08 LOG7[29231:25188864]: FD 10 in non-blocking mode 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp connecting 127.0.0.1:25 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: waiting 10 seconds 2006.10.04 11:08:08 LOG6[29231:2684415368]: Child process 29421 finished with code 0 2006.10.04 11:08:08 LOG7[29231:25188864]: connect_wait: connected 2006.10.04 11:08:08 LOG7[29231:25188864]: Remote FD=10 initialized 2006.10.04 11:08:08 LOG7[29231:25188864]: TCP_NODELAY option set on remote socket 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): before/ connect initialization 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL state (connect): SSLv3 write client hello A 2006.10.04 11:08:08 LOG7[29231:25188864]: SSL alert (write): fatal: handshake failure 2006.10.04 11:08:08 LOG3[29231:25188864]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.10.04 11:08:08 LOG5[29231:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.10.04 11:08:08 LOG7[29231:25188864]: ssmtp finished (0 left) Any suggestions as to what is causing this and how I can fix it? I got the same thing on another machine, with stunnel 4.04 and OpenSSL 0.9.7d. My stunnel.conf file is: cert = /Users/jlbrown/%1.pem key = /Users/jlbrown/%1.pem debug=7 output=/dev/stdout ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [ssmtp] client = yes accept = 465 connect = 192.168.1.31:25 Thanks, James.

2 1

Thanks
by Eric S. Eberhard 03 Oct '06

03 Oct '06

For the help ... I believe I got it. Was I got that debug bug fixed I could tell what was going on. In the end I just stopped fighting it and downloaded prngd and ran it for a while. Interestingly, once I did this, it continues to work fine w/out prngd up and running. It did something I don't understand to my random file (apparently the old one was not good enough) and now it works!##$ Don't understand it, but it works! I still have some other application problem but I appear to get responses now. Thanks, Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Re: [stunnel-users] Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Mike, Ah -- you are an expert! Amazing product in that I last download this in 2000 and have used it without incident ever since. Too bad I am forced to upgrade. I have hunted down the problem some more -- it has to do with the randomness. Using dbx I have found that it is blocking on a socked read for DEVRANDOM_EGD ... I did not specifically set up any sockets for randomness anyplace. Or set any options. I don't really want a socket, I was perfectly happy with my little 1024 byte .rnd file. If I copy a file (at random :-) ) and specify that it use that file for randomness, it reads it and sets it to zero bytes (unless I tell it not to overwrite). It then goes to read the socket and hangs. I suspect this is more an openssl problem than stunnel unless you can think of a way to 1) make it not wipe out my random file 2) make it not try and access a socket I hope you put my little fix in to s_log. Thanks, Eric At 01:51 PM 10/2/2006, you wrote: >On Monday 02 October 2006 21:19, you wrote: > > Are you an openssl/stunnel expert? > >I wrote stunnel. I could say I'm an expert (who an expert is otherwise?). > > > If I gave you access to my rs6000 > > and paid you, could you get this to work for me? Since I only need > > to compil this every 5-10 years, it makes little sense for me to > > invest a lot of time learning it! > >Good idea. > >Best regards, > Mike > This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Help please - debug and random file
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

2 3

One bug solved/fixed -- bug in log.c or perhaps options.c
by Eric S. Eberhard 02 Oct '06

02 Oct '06

Because I am using inetd mode, any unintended output by stunnel to stdout is BAD as this is accepted as input through inetd to my calling program. The problem with stunnel is that in main it does main_initialize which has the final function "log_open" However, somewhere in "parse_config" a call is made to "s_log" (with the text "Snagged 64 bytes from ..." and since this is before the log_open, the output ends up on stdout rather than being logged. Rather than try and hunt down the function that outputs the premature error message, I modified s_log to open the log files itself if not already open. I fixed it as follows (suggest you put in to the release?): void s_log(int level, const char *format, ...) { va_list arglist; char text[STRLEN], timestamped[STRLEN]; time_t gmt; struct tm *timeptr; #if defined(HAVE_LOCALTIME_R) && defined(_REENTRANT) struct tm timestruct; #endif if(level>options.debug_level) return; va_start(arglist, format); #ifdef HAVE_VSNPRINTF vsnprintf(text, STRLEN, format, arglist); #else vsprintf(text, format, arglist); #endif va_end(arglist); #if !defined (USE_WIN32) && !defined (__vms) /******************** NEW CODE, NEXT 2 LINES *******/ if(!outfile && options.output_file) /* 'output' option specified, not open */ log_open(); if(!outfile && options.option.syslog) { syslog(level, "LOG%d[%lu:%lu]: %s", So now I don't get the "Snagged" message back on stdout ... but it still does not work for me (yet :-) ) Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Setting up TLS for SMTP
by James Brown 01 Oct '06

01 Oct '06

I am trying to set up stunnel so that it accepts SSL encrypted traffic from the internet on port 2525 and sends it to my mail server on port 25. To create the certificate, I used: sudo openssl req -new -outform PEM -out smtpd.cert \ -newkey rsa:2048 -nodes -keyout smtpd.key -keyform PEM \ -days 365 -x509 My stunnel.conf is: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem cert = /smtpd.cert ;key = stunnel.pem key = /smtpd.key ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini I am trying it in standalone mode. Using Stunnel 4.04. OpenSSL 0.9.7i 14 Oct 2005 Output of gcc -v is: Using built-in specs. Target: powerpc-apple-darwin8 Configured with: /private/var/tmp/gcc/gcc-5341.obj~1/src/configure -- disable-checking -enable-werror --prefix=/usr --mandir=/share/man -- enable-languages=c,objc,c++,obj-c++ --program-transform-name=/^[cg] [^.-]*$/s/$/-4.0/ --with-gxx-include-dir=/include/c++/4.0.0 --with- slibdir=/usr/lib --build=powerpc-apple-darwin8 --host=powerpc-apple- darwin8 --target=powerpc-apple-darwin8 Thread model: posix gcc version 4.0.1 (Apple Computer, Inc. build 5341) Whenever I try to start Stunnel, I get a message saying that there is no such file. Eg: $ stunnel -p /smtpd.cert -d 2525 -r 25 2006.10.01 00:36:46 LOG3[638:2684415368]: -p: No such file or directory (2) Syntax: stunnel [filename] | -help | -version | -sockets filename - use specified config file instead of /sw/etc/ stunnel/stunnel.conf -help - get config file help -version - display version and defaults -sockets - display default socket options I am using Mac OS X 10.4.8, Stunnel was built using Fink. Does anybody have any suggestions as to what I am doing wrong? Thanks, James.

1 0

stunnel on osX
by fmgre-dell＠yahoo.fr 30 Sep '06

30 Sep '06

>From: Michal Trojnara <Michal.Trojnara(a)mobi-com.net> >Subject: Re: [stunnel-users] Tr: failure notice >To: stunnel-users(a)mirt.net >Message-ID: <200609292118.57291.Michal.Trojnara(a)mobi-com.net> >Content-Type: text/plain; charset="utf-8" >On Friday 29 September 2006 16:11, fmgre-dell(a)yahoo.fr wrote: >> We have been using stunnel for 2 years now. >> We need to renew our keys, and we usually proceed to a >> software upgrade at the same time. >> Â >> - I have noticed changes in stunnel-client ( 4.16 ) >> running on OSX : now, stunnel asks for the key >> password for each service it is launching. > >Just password from your private key. 8-) > Hello, What i mean is that we have 8 different services running. they are all locked with the same key. We distribute the private key to other non-computer persons, who don t know how to remove a password from a key ( and we 'd like to keep the key locked ) With the former version of stunnel, we could unlock the 8 services with typing the password only once With the latest version, we need to type in the keyword once for every service ( i.e. 8 times !!! ) Is there any way to 'ease' the use of the latest version while keeping the key passworded ? bon week end fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

Help please - debug and random file
by Eric S. Eberhard 29 Sep '06

29 Sep '06

Hello everyone. I have not been on the list for a long time. I last compiled openssl and stunnel in 2000 or so and have been using the same code ever since. I use it very simply in client mode ... I have an application to authorize credit cards and it connect to stunnel in inetd mode (with -c in the command line). visanet is now requiring version 2 SSL so I have to change so I got all the new stuff and compiled it up and made a .conf file. I have two problems (for now :-) ): 1) No matter what I do it seems that at least some debug is coming back through the socket, and no debug is going to my debug file 2) The debug I am getting is very strange -- the first time it says "Snagged 64 from bytes from stunnel.rnd" The second time it says "Unable to retrieve any random data from stunnel.rnd" When I examine the file it has a current date and zero bytes. If I copy back my old (2000) stunnel.rnd it always reads once, and then writes it back out with zero bytes. I am AIX 4.3.3 and I compiled with xlc and the only option I used that was not default was to not link in the wrappers. I did get a ton of warnings that the "-pthreaded" option was not valid ... but it executes and responds so I am not sure that matters? Or should I do something (what?) about that? My configuration files for the service (visanet) is: output = /tmp/stunnel.log debug = 7 RNDfile = /visanet/ssl/stunnel.rnd [visanet] client = yes connect = ssllab.pgs.wcom.net:443 sslVersion = SSLv2 protocol = smtp cert = /viasanet/ssl/stunnel.pem The rnd file and cert file are from 2000 (old old old!). I would have expected a file /tmp/stunnel.log -- the file is not even created! The old inetd line was: (blah blah) stunnel -r ssllab.pgs.wcom.net:443 -c -R /visanet/sslold/stunnel.rnd What stupid thing am I doing wrong? Does anyone else have experience using stunnel with visanet and can they give me any pointers? Thanks! Eric This email sent by: Eric S. Eberhard (928) 567-3727 Voice (928) 567-6122 Fax 928-301-7537 -- you may call any time day or night, I turn it off when I sleep :-) Please try to use a land line first (reception often poor). Note the change in the domain from vicspdi.com to vicsmba.com !!!! For Metropolis support and VICS MBA Support!!!! http://www.vicsmba.com Completely updated web site of personal pictures with many new pictures! Includes horses, dogs, Corvairs, and more. http://www.vicsmba.com/ourpics/index.html Corvair pictures including the Judson setup on our 62 Sedan and lots of pictures of Cheryl's 62 Monza Wagon and our 62 Spyder convertible. http://www.vicsmba.com/ourpics/corvairs.html My younger brother Martin has started a very serious car company. A hot rod (very fast) electric roadster is the first offering. The chassis is built by Lotus to their specs. Check it out: http://www.teslamotors.com

1 0

Tr: failure notice
by fmgre-dell＠yahoo.fr 29 Sep '06

29 Sep '06

Hello, We have been using stunnel for 2 years now. We need to renew our keys, and we usually proceed to a software upgrade at the same time. - I have noticed changes in stunnel-client ( 4.16 ) running on OSX : now, stunnel asks for the key password for each service it is launching. - a collegue is running stunnel ( client ) on windows and told me that the 4.15 and 4.16 version keeps on crashing on windows. Anybody with the same symptoms ( and possiby a workaround ? ) :-) ( we use keys which are protected by a password, we launch the stunnel ( client ) manually and type in the password for the service to start ) Sincerely, Fred ___________________________________________________________________________ Découvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! Yahoo! Questions/Réponses pour partager vos connaissances, vos opinions et vos expériences. http://fr.answers.yahoo.com

2 1

create_client failed
by James 29 Sep '06

29 Sep '06

I am running Debian 3.1 (stable) with stunnel 3.26 (Debian package) to wrap my qmail pop3 daemon. Stunnel works properly for a good amount of time, but at a point (I am unable to find any specific influencing factors) it begins to fail with the error, "Connection reject: create_client failed" (see below for more info). To fix the error I have to kill and restart stunnel. I have adjusted the timeouts for both stunnel and the pop3 daemon, but nothing appears to have a lasting affect. When stunnel errors out the pop3 daemon is still available and can be connected to, so it does not appear to be an issue related to stunnel not being able to talk to the pop3 daemon. Below I have some of the debugging and system information regarding the system and problem. I would be more than appreciative if anyone had some input. Thank you. # Error stunnel[2500]: pop3 accepted FD=9 ###.###.###.### stunnel[2500]: Connection rejected: create_client failed # strace -p select(7, [4 6], NULL, NULL, NULL) = 1 (in [6]) fcntl64(6, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0 accept(6, {sa_family=AF_INET, sin_port=htons(63759), sin_addr=inet_addr("###.###.###.###")}, [16]) = 9 fcntl64(6, F_SETFL, O_RDWR) = 0 fcntl64(9, F_SETFD, FD_CLOEXEC) = 0 rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT TERM CHLD], [], 8) = 0 mmap2(NULL, 8388608, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 close(9) = 0 time([1159535901]) = 1159535901 getpid() = 21864 rt_sigaction(SIGPIPE, {0x40253a70, [], 0}, {SIG_IGN}, 8) = 0 send(3, "<27>Sep 29 09:18:21 stunnel[2186"..., 77, 0) = 77 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 close(9) = -1 EBADF (Bad file descriptor) # uname -a 2.6.8-3-686-smp #1 SMP Thu Sep 7 04:39:15 UTC 2006 i686 GNU/Linux # libc version GNU C Library stable release version 2.3.2 # Command Running /usr/sbin/stunnel -d pop3s -r pop3 -p /etc/ssl/certs/pop3d.pem -R /dev/urandom -s nobody -g root # stunnel -V stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory /etc/ssl/certs -A file (none) -S sources 3 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /var/run/stunnel/ -p pemfile in server mode: /etc/ssl/certs/stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0

1 0

SSL and keep alive
by Alex Turner 29 Sep '06

29 Sep '06

All, I am load testing stunnel as a front end to a web server. The problem I have is that the connection is dropping even though JMeter is set to keep-alive on the http sampler. I was wondering if anyone knew if this was a JMeter issue – IE it does not do http1.1 properly with SSL or should I dig deeper? The stunnel log just shows the socket being closed down at the end of each request. Now – as stunnel should not care what data is going over ssl, then there must be something from JMeter that is triggering it to drop the socket. My thinking is that this is either an SSL session end or an actual FIN. In the absence of any feedback – I think I will try using stunnel in both client and server modes and, as I already know JMeter is OK at keep-alive non https – I should thus find out where the issue lays. Thanks for any info AJ PS – I am working on XP both ends with JMeter 2.2 and the latest stunnel. PPS – Naturally, once I have this figured I will post the method and results to nerds-central Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.12.9/457 - Release Date: 26/09/2006

2 3

Zombies in 4.17?
by Pete Resnick 28 Sep '06

28 Sep '06

I'm running 4.17 on a Mac Mini (Intel) running MacOSX 10.4.7 and I'm seeing a slew of zombies. Anything I can do to track down what the problem is? pr -- Pete Resnick <http://www.episteme-software.com/> All connections to the world are tenuous at best

2 2

stunnel 4.18 released
by Michal Trojnara 26 Sep '06

26 Sep '06

Version 4.18, 2006.09.26, urgency: MEDIUM: * Bugfixes - GPF on entering private key pass phrase on Win32 fixed. - Updated Win32 OpenSSL DLLs. - Minor configure script update. Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum for stunnel-4.18.tar.gz: 3ed3eaefae91d80fcfcbb29dd285d0f773756397 Best regards, Mike

1 0

Windows OpenSSL DLL Version
by algol sigfrid 26 Sep '06

26 Sep '06

2 1

seg fault stunnel 4-14 on SLES10
by Jon Howse 22 Sep '06

22 Sep '06

Hi, I am getting a seg fault with stunnel on an installation of SLES10. This is the first SLES10 server I have set up after having set up many SLES9 servers (approx twelve) which all communicate through stunnel to a central syslog server. The version of stunnel we are using on SLES9 is: stunnel-4.05-20.1. The other machines are a mix of 32bit and 64bit Xeons. The seg fault seems to happen when syslog starts to talk through stunnel. The program is a binary rpm install for 64bit SLES10 and is being run in standalone mode as a client connecting to a stunnel/syslog server running SLES9. OS:- SLES10 x86_64 Packages:- Stunnel 4-14-14.2 Syslog-ng-1.6.8-20.4 Openssl-0.9.8a-18.4 uname -a: Linux server 2.6.16.21-0.15-smp #1 SMP Tue Jul 25 15:28:49 UTC 2006 x86_64 x86_64 x86_64 GNU/Linux libc version: libc.so.6 => /lib64/libc.so.6 (0x00002ae068cf2000) openssl version: OpenSSL 0.9.8a 11 Oct 2005 stunnel.conf:- # Copyright by Michal Trojnara 2002-2004 # --with changes for SuSE package # client = yes | no # client mode (remote service uses SSL) # default: no (server mode) client = yes # # chroot + user (comment out to disable) # chroot = /var/lib/stunnel/ setuid = stunnel setgid = nogroup # note about the chroot feature and the "exec" keyword to start other # services... # while the init script /etc/init.d/stunnel will copy the binaries and libraries # into the chroot jail, more files might be needed in the jail (configuration files etc.) pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /var/log/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # compression = rle # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff # verify = 2 # Don't forget to c_rehash CApath; CApath is located inside chroot jail: # CApath = /certs # It's often easier to use CAfile: # CAfile = /etc/stunnel/certs.pem # Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: # CRLpath = /crls # Alternatively you can use CRLfile: # CRLfile = /etc/stunnel/crls.pem CAfile = /etc/openldap/rootcert.pem cert = /etc/ssl/certs/thorincert.pem key = /etc/ssl/certs/thorinkey.pem verify = 2 [5140] accept = 127.0.0.1:514 connect = xxx.xxx.xxx.xxx:5140 /var/log/messages:- kernel: Kernel logging (proc) stopped. Sep 21 13:51:00 thorin kernel: Kernel log daemon terminating. Sep 21 13:51:01 thorin syslog-ng[3146]: syslog-ng version 1.6.8 going down Sep 21 13:51:01 thorin syslog-ng[3769]: syslog-ng version 1.6.8 starting Sep 21 13:51:01 thorin syslog-ng[3769]: Changing permissions on special file /dev/tty10 Sep 21 13:51:01 thorin syslog-ng[3769]: Connection broken to AF_INET(127.0.0.1:514), reopening in 60 seconds Sep 21 13:51:06 thorin kernel: klogd 1.4.1, log source = /proc/kmsg started. Sep 21 13:51:06 thorin kernel: stunnel[3739]: segfault at 000000005569a9f0 rip 000055555555b793 rsp 00005555556b2f60 error 4 var/log/stunnel.log:- stunnel 4.14 on x86_64-suse-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2006.09.21 13:48:25 LOG7[3396:1]: RAND_status claims sufficient entropy for the PRNG 2006.09.21 13:48:25 LOG6[3396:1]: PRNG seeded successfully 2006.09.21 13:48:25 LOG7[3396:1]: Certificate: /etc/ssl/certs/thorincert.pem 2006.09.21 13:48:25 LOG7[3396:1]: Key file: /etc/ssl/certs/thorinkey.pem 2006.09.21 13:48:25 LOG7[3396:1]: Loaded verify certificates from /etc/openldap/rootcert.pem 2006.09.21 13:48:25 LOG6[3396:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.09.21 13:48:25 LOG6[3396:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.09.21 13:48:25 LOG5[3396:1]: 500 clients allowed 2006.09.21 13:48:25 LOG7[3396:1]: FD 4 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 5 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: FD 6 in non-blocking mode 2006.09.21 13:48:25 LOG7[3396:1]: SO_REUSEADDR option set on accept socket 2006.09.21 13:48:25 LOG7[3396:1]: 5140 bound to 127.0.0.1:514 2006.09.21 13:48:25 LOG7[3397:1]: Created pid file /var/run/stunnel.pid 2006.09.21 13:48:25 LOG7[3397:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=4, (IN)->() 2006.09.21 13:49:20 LOG7[3397:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.09.21 13:49:20 LOG7[3397:1]: 5140 accepted FD=7 from 127.0.0.1:7323 2006.09.21 13:49:20 LOG7[3397:1]: Creating a new context 2006.09.21 13:49:20 LOG7[3397:1]: Context 2 created 2006.09.21 13:49:20 LOG7[3397:2]: Context swap: 1 -> 2 It waits at the last entry until syslog tries to connect. And that's where the useful logging stops, after that it's a seg fault. Hope you can point me in the right direction... Jon Howse ---------------------------------------------------------------------------- St Brendan's Sixth Form College --- STAFF e-mail Please consider the environment before printing this email. This e-mail is confidential and intended solely for the use of the individual to whom it is addressed. Any views or opinions presented are solely those of the author and do not necessarily represent those of St Brendan's Sixth Form College. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender. Please report any abuse of this e-mail service to postmaster(a)stbrn.ac.uk ---------------------------------------------------------------------------- *** This e-mail has been scanned by Symantec Anti-Virus software. ***

1 0

Would you plz help me? I have problem with defining ciphers in stunnel
by hjanzadeh＠sinamicro.com 19 Sep '06

19 Sep '06

1 0

4.17 stunnel with syslog-ng
by Jason Englander 15 Sep '06

15 Sep '06

I have a logging server at home set up with syslog-ng and stunnel. Earlier this morning, I upgraded stunnel on a logging client machine from 4.15 to 4.17, no problems. I upgraded the server from 4.15 to 4.17 and stunnel seemed to hang (run, but not detach) on startup. Very long story short (it was too early, I hadn't had enough coffee yet <g>), stunnel was trying to log to syslog, which wasn't running yet. Putting aside that I should've been using "output = /var/log/stunnel.log" instead, for a log server of all things :-), did something change in stunnel or did I screw something up that I don't remember doing? My startup script has been starting stunnel, then syslog-ng for years. I haven't downgraded to verify that it does/doesn't happen starting with a particular version, but I might do that later today out of curiosity. (before fixing, upgrading "important" machines) Also, FYI - configure created a file named "6," in the source directory with this in it: no LIBS=-lz -ldl -lutil -lpthread -L/usr/local/ssl/lib -lssl -lcrypto This seems to be the offending line in configure: echo "${ECHO_T}no" >&6, LIBS="$saved_LIBS" -> echo "${ECHO_T}no" >&6; LIBS="$saved_LIBS" I ran 'autoreconf -f -i' (autoconf 2.60, automake 1.9.6) and the line isn't in the new ./configure any more. Jason -- Jason Englander <jason(a)englanders.cc> 394F 7E02 C105 7268 777A 3F5A 0AC0 C618 0675 80CA

2 1

cannot compile stunnel on solaris 10 in a zone
by tomvo＠absi.be 15 Sep '06

15 Sep '06

Hi, I'm trying to compile stunnel on a solaris 10 (06/06 release) in a normal (non-global) zone. the compile fails at the mknod command. How do I install stunnel ? I could ofcourse create the device myself in the global zone, but i think it was in /usr/local/var/lib/stunnel/dev, I don't think that our user zone will have access to this device if we create it in the global zone. Anyone else struggled with the same problem ? thx, Tom. --------------------------------------------------------------------------- Tom Van Overbeke - ABSI Service Delivery Coordinator email: tomvo(a)absi.be Tel: +32 2 333 40 00 - Fax: +32 2 333 40 60 website: http://www.absi.be ---------------------------------------------------------------------------

1 0

stunnel problem on hp-ux 11.11
by matt.miller＠accenture.com 13 Sep '06

13 Sep '06

System specs: HP-UX 11.11 Stunnel 4.15 OpenSSL 0.8.7i Config File: ; Certificate/key is needed in server mode and optional in client mode ;cert = /opt/iexpress/stunnel/etc/stunnel/mail.pem ;key = /opt/iexpress/stunnel/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /opt/iexpress/stunnel/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /tmp/stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /opt/iexpress/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /opt/iexpress/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;foreground = yes output = stunnel.log ; Service-level configuration [pop3s] ; Use it for client mode client = yes ;accept = 995 ;connect = 110 accept = localhost:110 connect = POP3S.MAILSERVER:995 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Problem: When I try to execute the following command "telnet localhost 110" I get an entry in the stunnel log file and I am unable to connect to the secure pop3 server. I know that this is not a firewall issue because I can telnet directly to the POP3S.MAILSERVER on port 995 and establish a connection, I also know that the server works fine because I set up stunnel on my windows xp machine and that did not have a problem establishing a connection. Any help on this issue would be great. Here is the log I am getting 2006.08.10 18:23:03 LOG5[16138:1]: stunnel 4.15 on hppa2.0w-hp-hpux11.11 with Op 2006.08.10 09:43:55 LOG5[7158:1]: 2000 clients allowed 2006.08.10 09:43:55 LOG7[7158:1]: FD 4 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 5 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: FD 6 in non-blocking mode 2006.08.10 09:43:55 LOG7[7158:1]: SO_REUSEADDR option set on accept socket 2006.08.10 09:43:55 LOG7[7158:1]: pop3s bound to 127.0.0.1:110 2006.08.10 09:43:55 LOG7[7263:1]: Created pid file /tmp/stunnel.pid 2006.08.10 16:15:45 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57040 2006.08.10 16:15:45 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:30:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57156 2006.08.10 16:30:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 16:45:34 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57275 2006.08.10 16:45:34 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:00:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57401 2006.08.10 17:00:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:15:36 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57506 2006.08.10 17:15:36 LOG3[7263:1]: Connection rejected: create_client failed 2006.08.10 17:30:35 LOG7[7263:1]: pop3s accepted FD=0 from 127.0.0.1:57614 2006.08.10 17:30:35 LOG3[7263:1]: Connection rejected: create_client failed Matt T. Miller Accenture Minneapolis, MN USA 612-277-1826 aim: mttmiller8 email: matt.miller(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

RE: [stunnel-users] stunnel and AJP
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Any chance you could send me a sample configuration file? :) Just got it install and going to start trying to get it setup. I am going to try to end the tunnel on a BigIP box. So just set it up on the apache server and hope it can end on the BigIP box. Thanks -----Original Message----- From: Richard.Hall [mailto:[email protected]] Sent: Friday, August 25, 2006 4:08 PM To: Jones Scott - sjones Cc: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] stunnel and AJP Jason, On Fri, 25 Aug 2006, Jones Scott - sjones wrote: > Has anyone used stunnel to secure AJP traffic from apache to jboss Short answer: Yes. - Apache + mod_jk configured to talk to stunnel client on localhost rather than to JBoss AJP13 port - stunnel client talks to remote stunnel server - stunnel server talks to JBoss AJP13 port on _its_ localhost. Works a treat :-) We've even done it with a third machine in the middle, running an stunnel server and client back-to-back. Just don't ask why! HTH, Richard ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

2 1

stunnel going to BigIP ssl
by Jones Scott - sjones 13 Sep '06

13 Sep '06

Has anyone used stunnel to end at a BipIP to decode the ssl traffic? If so, any issues or concerns? Thanks *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

"SSL_read returned WANT_READ: retrying" at 30Hz
by Vincent Lascaux 12 Sep '06

12 Sep '06

Hi, I'm trying to use rsync (2.6.8) through STunnel (4.16) to synchronize two PC over the internet (they both have the same version of stunnel and rsync). On the server, I have STunnel running with this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log [rsync] accept = 273 connect = 873 On the client I have this configuration: cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=0 socket = r:TCP_NODELAY=0 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log client = yes [rsync] accept = 873 connect = UrlOfMyServer:273 Then I connect with rsync using rsync -a -h --progress --stats --partial Account@localhost::RemotePath LocalPath I think the connection is not really stable. RSync sometimes hang. The log file on the client side show 2006.09.11 21:33:11 LOG7[2008:1468]: SSL_read returned WANT_READ: retrying at 30Hz (that's right, it means 30 times a second). My log file nearly gets bigger faster than my downloaded file ;) Is it expected? What does this line mean? I turned TCP_NODELAY to 0 thinking that it my give me synchronous sockets and that it would remove that error, but it didn't... Any help appreciated, Thanks -- Vincent

2 3

Stunnel 4.17 released
by Michal Trojnara 10 Sep '06

10 Sep '06

This is a bugfix release. Upgrade is recommended. Version 4.17, 2006.09.10, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8c. * Bugfixes - Problem with detecting getaddrinfo() in ./configure fixed. - Compilation problem due to misplaced #endif in ssl.c fixed. - Duplicate 220 in smtp_server() function in protocol.c fixed. - Minor os2.mak update. - Minor update of safestring()/safename() macros. sha1sum for stunnel-4.17.tar.gz file: 7a0ea800935e798bf938756000b57d002a99c280 Homepage and download: http://stunnel.mirt.net/ Best regards, Mike

1 0

Multiple HTTPS endpoints
by Andrew Culross 07 Sep '06

07 Sep '06

Can I use stunnel to connect mutiple https endpoints? I'm wondering if a config file like the below would work: [https] accept = 9876 connect = xxx.xxx.xxx.xxx:443 [https] accept = 9875 connect =yyy.yyy.yyy.yyy:443 Thanks in advance ! Andrew Culross TwoFour Systems (914) 220-8849 www.TwoFour.Com The views and opinions expressed in this e-mail message are the sender's own and do not necessarily represent the views and opinions of {TwoFour Systems, LLC or F-O-R Software, LLC}

1 0

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 07 Sep '06

07 Sep '06

Hans Werner Strube wrote: > Michal Trojnara wrote: ... > > I'm going to do it the hard way and add another parameter to > > s_poll_wait() function. > > > > IMHO the timeout should be between 100ms and 500ms. What do you think? > > I have not tested the minimum required. However, it should be as short > as possible, since for a client using TLS, the full delay will always > occur on starting a connection. ... I have now done some measurements using snoop on a Solaris Ultra 2 SMTP server (100 MBit/s) with a Windows XP SP2 client (AMD Duron 1 GHz, 56 kBit/s phone-line modem, SeaMonkey 1.04 mail sender [equivalent to Thunderbird 1.5.x]). The delays between the end of initial connection handshake and the first nonzero data packet for six connections were usually between 10 and 100 ms but once reached 150 ms. Thus, 200 ms may be a reasonable value (although the sample is too small to rule out rare failures).

1 0

windows load levels
by Alex Turner 05 Sep '06

05 Sep '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ Alexander J Turner Ph.D. HYPERLINK "http://www.deployview.com"www.deployview.com HYPERLINK "http://www.nerds-central.blogspot.com"www.nerds-central.blogspot.com HYPERLINK "http://www.project-network.com"www.project-network.com -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.11.7/437 - Release Date: 04/09/2006

2 1

Stunnel and CryptoApi
by Marco Aldegheri 05 Sep '06

05 Sep '06

Hello list! Someone knows if there is any way to integrate a Windows stunnel in client mode with the Windows Certificate Store? As OpenVPN does with the cryptoapicert parameter in my opinion it would be very useful because: 1. the private key would not just reside in a pem file but could be set not exportable. 2. the private key could be saved on a smartcard. I found a japaneese wstunnel project that seems to do it but I couldn't find any document about it in english and the gui is only in japaneese. Any hints? Thank you, Marco Aldegheri __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Real address of client
by Gonzalo Diethelm 03 Sep '06

03 Sep '06

Hello, linux: Linux asus-gonzo 2.6.15-26-686 #1 SMP PREEMPT Thu Aug 3 03:13:28 UTC 2006 i686 GNU/Linux stunnel: stunnel 4.14 on i486-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 apache: Apache/2.0.55 I am using stunnel in Ubuntu to provide https serving to an http-only Apache installation. The stunnel config is: cert = /home/gonzo/src/bg/run/SSL/server.crt key = /home/gonzo/src/bg/run/SSL/server.crt chroot = /var/run/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = no [https] accept = 443 connect = 80 TIMEOUTclose = 0 Everything works perfectly, except for one minor detail: on the server, my PHP scripts do not have access to the real IP address of the client, and they always see this value as 127.0.0.1. I am aware the manual says that, if you use -l or -L, there will be an additional REMOTE_HOST environment variable with the desired IP address, but I am not sure how to make this work from a setup like mine, where the http server process is already running. Any help or hints are greatly appreciated. Best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

4.16 compilation fails for openssl without engine
by Hans Werner Strube 01 Sep '06

01 Sep '06

When openssl was compiled without engine support, compilation of src/ssl.c in stunnel-4.16 fails because of a misplaced #endif. Patch: --- src/ssl.c.ORI Thu Jun 29 23:12:03 2006 +++ src/ssl.c Fri Sep 1 11:30:25 2006 @@ -286,8 +286,6 @@ s_log(LOG_DEBUG, "Engine %d initialized", current_engine+1); } -#endif - ENGINE *get_engine(int i) { if(i<1 || i>current_engine) return NULL; @@ -294,4 +292,6 @@ return engines[i-1]; } +#endif + /* End of ssl.c */

1 0

Duplicate 220 in protocol.c, smtp_server
by Hans Werner Strube 01 Sep '06

01 Sep '06

At least since stunnel 4.15 - but not yet in 4.09 (don't know about the intermediate versions) - there is a (cosmetic only?) bug in the "welcome" forwarding of the smtp_server in protocol.c (lines 177-187 in 4.16): fdgetline(c, c->remote_fd.fd, line); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fdprintf(c, c->local_wfd.fd, "220%s + stunnel", line); fdgetline(c, c->local_rfd.fd, line); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); longjmp(c->err, 1); } Although the line read from remote_fd.fd already starts with "220", another 220 is prepended in forwarding to local_wfd.fd, line 182. This seems to haveno adverse effects, but this line should better be changed to: fdprintf(c, c->local_wfd.fd, "%s + stunnel", line);

1 0

stunnel 4.16 released
by Michal Trojnara 01 Sep '06

01 Sep '06

A new version of stunnel has been released. Version 4.16, 2006.08.31, urgency: MEDIUM: * New features sponsored by Hewlett-Packard - A new global option to control engine: engineCtrl = <command>[:<parameter>] - A new service-level option to select engine to read private key: engineNum = <engine number> - OCSP support: ocsp = <URL> * New features - A new option to select version of SSL protocol: sslVersion = all|SSLv2|SSLv3|TLSv1 - Visual Studio vc.mak by David Gillingham <dgillingham(a)gmail.com>. - OS2 support by Paul Smedley (http://smedley.info) * Bugfixes - An ordinary user can install stunnel again. - Compilation problem with --enable-dh fixed. - Some minor compilation warnings fixed. - Service-level CRL cert store implemented. - GPF on protocol negotiations fixed. - Problem detecting addrinfo() on Tru64 fixed. - Default group is now detected by configure script. - Check for maximum number of defined services added. - OpenSSL_add_all_algorithms() added to SSL initialization. - configure script sections reordered to detect pthread library funcions. - RFC 2487 autodetection improved (thx to Hans Werner Strube). High resolution s_poll_wait() not currently supported by UCONTEXT threading. - More precise description of cert directory file names (thx to Muhammad Muquit). * Other changes - Maximum number of services increased from 64 to 256 when poll() is used. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1 hash for stunnel-4.16.tar.gz file: 6772e0c7f26c2596564ba66978597db8cd229a72 Best regards, Mike

2 1

Windows simultaneous sockets
by Alex 26 Aug '06

26 Aug '06

Guys, Bit of a newbie question here - but very import to me at least. We are looking to secure a web server that does no currently support SSL. One reason for this is that we want to be able to run the server on multiple hosts and doing so means sharing the sessions etc :-( So - I am interested if anyone has tested the stuffing out of stunnel on windows. IE seeing how well it could handle several hundred sockets simultaneously. Not only from a resource point of view, but from a scaling (n, n**2 etc) point of view. Any input at all will be very welcome. Soon I will be starting some test of my own using JMeter to load test. If anyone is interested in the results I will be happy to post. Cheers AJ -- www.deployview.com www.nerds-central.com www.project-network.com

1 0

stunnel and AJP
by Jones Scott - sjones 25 Aug '06

25 Aug '06

Has anyone used stunnel to secure AJP traffic from apache to jboss *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

2 1

stunnel 4-15 through proxy server
by Ingvar Tjøstheim 25 Aug '06

25 Aug '06

Hello I am on a network at work behind a firewall and a proxy server. I can connect to my friends linux computer with putty using proxy configuration and port 443. My friend set up his SSH server on port 443, of course. Yesterday, back home, I installed the following on my Windows2000 computer: Win32OpenSSL-v0.9.8b stunnel ver 4-14 FreeProxy version 3.92 This is the stunnel config file for my home computer: client=no verify=0 [wow] accept = 443 connect = 127.0.0.1:3456 TIMEOUTclose = 0 I set up my router to forward port 443 to this computer. I also registered a DynDNS domain and set up a client to update it. Then, still at home, I prepared another computer which I brought to work today. I installed the following on an XP machine: Win32OpenSSL-v0.9.8b stunnel ver 4-14 (which I upgraded to 4.15 today) SockScap_sc32r238 I set up SockScap to connect to 127.0.0.1 on port 2345 and used it to tunnel a program to the internet through my LAN and this Win2K computer. This was working fine when I was at home. My network at home has no proxy server, and I changed stunnel on my XP computer once at work to version 4-15. Then I added the two protocol lines in the config file as you see below. This is the config file on my XP computer at work: verify = 0 client = yes [wow] accept = 2345 protocol = connect protocolHost = www-proxy.DOMAINNAME.no:80 connect = MYDOMAINNAME.dnsalias.com:443 TIMEOUTclose = 0 Now, the funny thing is that it doesn't work. I used to have a SSH server on my computer at home (which is not running now), and I could connect to it from work. I know the setup could work if I just did things right. I know the FreeProxy and SockScap stuff works, cause it did at home. stunnel and the network is the only difference. Still I get these messages on the XP machine running stunnel as client at work when the SockScap program connects to it: 2006.08.25 10:02:29 LOG5[1280:2940]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.25 10:02:29 LOG5[1280:2940]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.08.25 10:02:29 LOG5[1280:2156]: No limit detected for the number of clients 2006.08.25 10:02:59 LOG5[1280:664]: wow connected from 127.0.0.1:3723 2006.08.25 10:03:05 LOG5[1280:972]: wow connected from 127.0.0.1:3725 2006.08.25 10:03:09 LOG5[1280:664]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.08.25 10:03:15 LOG5[1280:972]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ...and it doesn't work. The program I try using through the tunnel never manages to connect. Anyone have a clue? Thank you very much!

1 0

Re: [stunnel-users] safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

Michal Trojnara wrote: > Assuming on some systems isprint(x) != isprint(x&0xff): any idea how to > exploit this "insecure" code? > > BTW: At least on Linux and Mac OS X isprint() returns 0 in both cases. The same holds for Solaris. I did not actually encounter an error but just got the idea that something may be insecure here by looking at the lines. After all, isprint etc. are often table-based macros without range-checking the argument. And "man isprint" clearly says that the character is unsigned: (Solaris:) The macro isascii() is defined on all integer values; the rest are defined only where the argument is an int, the value of which is representable as an unsigned char, or EOF, (Linux:) These functions check whether c, which must have the value of an unsigned char or EOF, falls into a certain character class according to the current locale.

1 0

safestring and safename insecure
by Hans Werner Strube 24 Aug '06

24 Aug '06

The macros safestring and safename in common.h are insecure if called for a character with high bit set, because (int)*p will sign-extend the byte on machines where char is signed. Possible patch (here for safestring; for safename correspondingly with isprint -> isalnum): do {char *p; for(p=(s); *p; p++) if(!isprint((int)*(unsigned char *)p)) *p='.';} while(0)

2 1

Re: [stunnel-users] accept is not allowed in inetd mode
by Tomasz Feliksiak 24 Aug '06

24 Aug '06

> I'm afraid I won't be able to tell you what's wrong with your > /etc/stunnel/smtps.conf without your /etc/stunnel/smtps.conf file. > 8-) > I guess you didn't define any service section. > > BTW. Please make sure to read the fine manual. There's also a Polish > version. > http://stunnel.mirt.net/static/stunnel.pl.html > > Greetings from Poland, > Mike You were right. I only define ports but dont uncomment protocol names in [] (like [pop3s]). [pop3s] accept = 995 connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 Now it looks like this and it's working (earlier i have two configs, one per service). Poor thing about this is that it don't log anything before you dont uncomment this [] :P - hope no one other make this mistake. When I uncomment everything else was simple cause I have log :) and know what's going on. There was a problem with binding to ports cause I try to run it by inetd but I find your post at google to not run it by inetd. I change stunnel-inetd-4.15-1 to stunnel-standalone-4.15-1 (PLD Rulez :P) and problems gone. Is possible to run stunnel by inetd??? Thanks for help Michal. Stunnel is great :) Ps. I read the manual, english version. Sad thing is that I dont find out where I make mistake and when I read Polish wersion I do. Good thing is that it will be help for others who make this simple mistake. -- Pozdrawiam Tomasz Feliksiak vonom(a)intertel.net.pl

2 2

Stunnel Crash: Gmail SMTP over TLS
by Shatadal Ghosh 23 Aug '06

23 Aug '06

Hi, I am using stunnel 4.15 on Windows XP SP1 with Mozilla Thunderbird as the e-mail client. I do not have openSSL installed locally. I do have the libssl32.dll and libeay32.dll in the same directory as stunnel.exe (C:\Program Files\stunnel). I am running stunnel as a service. Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail. According to the e-mail client configuration page on the gmail website http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555 I tried to use SMTP over TLS to connect to smtp.gmail.com:587 My gmail-smtps block in stunnel.conf was ; SMTP service, listens on localhost:250 [gmail-smtps] protocol=smtp accept=localhost:250 connect=smtp.gmail.com:587 On trying to send an e-mail message via the above configuration stunnel crashed. The log file is as follows 2006.06.14 03:17:15 LOG5[3956:3512]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.06.14 03:17:15 LOG5[3956:3512]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.06.14 03:17:15 LOG5[3956:3600]: No limit detected for the number of clients 2006.06.14 03:17:15 LOG7[3956:3600]: FD 172 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-pop3s bound to 127.0.0.1:1100 2006.06.14 03:17:15 LOG7[3956:3600]: FD 180 in non-blocking mode 2006.06.14 03:17:15 LOG7[3956:3600]: SO_REUSEADDR option set on accept socket 2006.06.14 03:17:15 LOG7[3956:3600]: gmail-smtps bound to 127.0.0.1:250 ....# info about other mail connections 2006.06.14 03:17:26 LOG7[3956:3600]: gmail-smtps accepted FD=236 from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:3600]: Creating a new thread 2006.06.14 03:17:26 LOG7[3956:3600]: New thread created 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps started 2006.06.14 03:17:26 LOG7[3956:2812]: FD 236 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on local socket 2006.06.14 03:17:26 LOG5[3956:2812]: gmail-smtps connected from 127.0.0.1:3665 2006.06.14 03:17:26 LOG7[3956:2812]: FD 268 in non-blocking mode 2006.06.14 03:17:26 LOG7[3956:2812]: gmail-smtps connecting 64.233.167.111:587 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: waiting 10 seconds 2006.06.14 03:17:26 LOG7[3956:2812]: connect_wait: connected 2006.06.14 03:17:26 LOG7[3956:2812]: Remote FD=268 initialized 2006.06.14 03:17:26 LOG7[3956:2812]: TCP_NODELAY option set on remote socket 2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp (client side) started 2006.06.14 03:17:26 LOG7[3956:2812]: <- 220 mx.gmail.com ESMTP w66sm450524pyw 2006.06.14 03:17:26 LOG7[3956:2812]: -> 220 mx.gmail.com ESMTP w66sm450524pyw <logfile ends> What mistake am I making? Fortunately it seems that gmail supports SMTP over SSL too (smtp.gmail.com:465) and I am using that. However I am also facing this problem with another account which unfortunately allows SMTP only over TLS. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0624-1, 06/13/2006 Tested on: 6/14/2006 6:22:04 AM avast! - copyright (c) 2000-2006 ALWIL Software. http://www.avast.com _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee® Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

Re: [stunnel-users] RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

Michal Trojnara wrote: > On 2006-08-22, at 10:55, Hans Werner Strube wrote: > > Instead of waiting, a better method would > > be to have a finer timeout resolution than 1 sec in > > s_poll_wait(...,...); > > setting the timeout to 1 (sec) would be too embarrassing for TLS > > connections. But this would require major changes in the sources. > > I'm going to do it the hard way and add another parameter to > s_poll_wait() function. > > IMHO the timeout should be between 100ms and 500ms. What do you think? I have not tested the minimum required. However, it should be as short as possible, since for a client using TLS, the full delay will always occur on starting a connection. It should be documented somewhere how this new constant could be configured in compilation.

1 0

RFC 2487 test in smtp_server not reliable
by Hans Werner Strube 23 Aug '06

23 Aug '06

In protocol.c, function smtp_server(), a test for plain SSL or STARTTLS usage (RFC 2487) is based on the availability of data from the client (c->local_rfd.fd). This works well in fast LANs but often fails for WAN connections through slow V90 modems. Especially with new Mozilla-based clients (also KMail and Evolution reported by other users) under Windows XP SP2 the test for data fails almost always, incorrectly resulting in an RFC 2487 handshake with error "Unknown client EHLO". This depends to some extent on the client: Outlook Express mostly works, Mozilla 1.7.x often worked after initial failure, SeaMonkey 1.x always fails. This seems to be a timing problem. I tried inserting a "usleep(50000);" before the switch(s_poll_wait(...)), which made SSL work with SeaMonkey (but often not for the first mail-sending attempt). Unfortunately, in Solaris 7 (where I tested stunnel), usleep is not yet thread-safe, maybe nanosleep(...,...) is preferable. Instead of waiting, a better method would be to have a finer timeout resolution than 1 sec in s_poll_wait(...,...); setting the timeout to 1 (sec) would be too embarrassing for TLS connections. But this would require major changes in the sources.

2 1

accept is not allowed in inetd mode
by vonom 23 Aug '06

23 Aug '06

Hello When i try to run stunnel by scripts or by hand stunnel /etc/stunnel/stunnel.conf (or other config) i see something like that: -bash-3.1# stunnel /etc/stunnel/pop3s.conf 2006.08.23 01:45:17 LOG7[24189:3083933376]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:45:17 LOG6[24189:3083933376]: PRNG seeded successfully 2006.08.23 01:45:17 LOG7[24189:3083933376]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:45:17 LOG7[24189:3083933376]: SSL context initialized for service stunnel file /etc/stunnel/pop3s.conf line 64: accept is not allowed in inetd mode No stunnel sesion, open ports or anything. I was very happy when I find out that I have stunnel-inetd-4.15-1 in my disto and it runs and ports are open. Everything great but when i try to send or receive email (postfix) it dont work. I spend a lot of time and a while ago i write telnet localhost 465 (or 995), ehlo hostname and see: -bash-3.1# telnet localhost 465 Trying 127.0.0.1.465... Connected to localhost. Escape character is '^]'. 2006.08.23 01:56:20 LOG7[24343:3083708096]: RAND_status claims sufficient entropy for the PRNG 2006.08.23 01:56:20 LOG6[24343:3083708096]: PRNG seeded successfully 2006.08.23 01:56:20 LOG7[24343:3083708096]: Certificate: /etc/stunnel/host-cert.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: Key file: /etc/stunnel/host-key.pem 2006.08.23 01:56:20 LOG7[24343:3083708096]: SSL context initialized for service stunnel file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. When I write telnet localhost 25 -bash-3.1# telnet localhost 25 Trying 127.0.0.1.25... Connected to localhost. Escape character is '^]'. 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250 8BITMIME So It's OK I think. file /etc/stunnel/smtps.conf line 64: accept is not allowed in inetd mode Connection closed by foreign host. -line 64 point just last line of config file. I have no idea what it could be. Anyone know how to fix that?

2 1

Protocol using Connect
by Hutchison, Alan 21 Aug '06

21 Aug '06

I am trying to use the protocol entries in the config file as shown below (xyz substituted to protect employer & vendor). Below is the log. Stunnel abends as it is trying to authenticate to our corporate proxy. The network guys are seeing the attempt to authenticate but it does not appear to complete. Any thoughts? key=maxstpb.crt debug=7 output=stunnel.log client=yes [MarketAxess] accept=127.0.0.1:12345 delay=yes TIMEOUTbusy=120 TIMEOUTconnect=120 connect=xyz.xyz.com:80 protocol=connect protocolHost=xyz.xyz.com:443 protocolCredentials=xyz:xyz 2006.08.21 15:13:24 LOG5[2520:1312]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.08.21 15:13:24 LOG5[2520:1312]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv4 2006.08.21 15:13:24 LOG5[2520:3184]: No limit detected for the number of clients 2006.08.21 15:13:24 LOG7[2520:3184]: FD 192 in non-blocking mode 2006.08.21 15:13:24 LOG7[2520:3184]: SO_REUSEADDR option set on accept socket 2006.08.21 15:13:24 LOG7[2520:3184]: MarketAxess bound to 127.0.0.1:12345 2006.08.21 15:14:00 LOG7[2520:3184]: MarketAxess accepted FD=200 from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:3184]: Creating a new thread 2006.08.21 15:14:00 LOG7[2520:3184]: New thread created 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess started 2006.08.21 15:14:00 LOG7[2520:2560]: FD 200 in non-blocking mode 2006.08.21 15:14:00 LOG5[2520:2560]: MarketAxess connected from 127.0.0.1:4200 2006.08.21 15:14:00 LOG7[2520:2560]: FD 416 in non-blocking mode 2006.08.21 15:14:00 LOG7[2520:2560]: MarketAxess connecting xyz.xyz.xyz.xyz:80 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: waiting 120 seconds 2006.08.21 15:14:00 LOG7[2520:2560]: connect_wait: connected 2006.08.21 15:14:00 LOG7[2520:2560]: Remote FD=416 initialized 2006.08.21 15:14:00 LOG5[2520:2560]: Negotiations for connect (client side) started 2006.08.21 15:14:00 LOG7[2520:2560]: -> CONNECT xyz.xyz.com:443 HTTP/1.1 Alan R. Hutchison 515-362-1272 -----Message Disclaimer----- This e-mail message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended recipient, any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by reply email to Connect(a)principal.com and delete or destroy all copies of the original message and attachments thereto. Email sent to or from the Principal Financial Group or any of its member companies may be retained as required by law or regulation. Nothing in this message is intended to constitute an Electronic signature for purposes of the Uniform Electronic Transactions Act (UETA) or the Electronic Signatures in Global and National Commerce Act ("E-Sign") unless a specific statement to the contrary is included in this message. While this communication may be used to promote or market a transaction or an idea that is discussed in the publication, it is intended to provide general information about the subject matter covered and is provided with the understanding that The Principal is not rendering legal, accounting, or tax advice. It is not a marketed opinion and may not be used to avoid penalties under the Internal Revenue Code. You should consult with appropriate counsel or other advisors on all matters pertaining to legal, tax, or accounting obligations and requirements.

1 0

limit connections per certificate
by Eric H. Jung 14 Aug '06

14 Aug '06

Hi, I'd like to limit the number of connections to stunnel (in server mode) by client certificate. In other words, I want all clients to only have 1 open socket connection to the server at a time. Is this possible with stunnel out-of-the-box, or must I write a patch to handle it? Thank you, grimholtz

1 0

stunnel through xinetd: process not terminating after use
by Alex Forrow 07 Aug '06

07 Aug '06

Hi, Im using stunnel through xinetd to forward some local unencrypted ldap connections to our ssl ldap server. Seems to work ok but after each use the stunnel process does not terminate, so I end up with losts of processes not doing anything. After a few days, these processes reach a limit and connections fail. As you can see, the connection has finished, but the process still exists: [root@lynx stunnel]# ps -e | grep stunnel 2396 ? 00:00:00 stunnel 2517 ? 00:00:00 stunnel 2575 ? 00:00:00 stunnel 2576 ? 00:00:00 stunnel [root@lynx stunnel]# netstat -p | grep stunnel tcp 0 0 lynx.seekit.co.uk:ldaplo lynx.seekit.co.uk:60390 CLOSE_WAIT 2396/stunnel unix 2 [ ] DGRAM 3204569 2576/stunnel unix 2 [ ] DGRAM 3204562 2575/stunnel unix 2 [ ] DGRAM 3203127 2517/stunnel unix 2 [ ] DGRAM 3202108 2396/stunnel Heres the xinetd configuration for stunnel (/etc/xinetd.d/ldaplo): # default: on # description: Stunnel to connect to LDAP for an insecure local session service ldaplo { disable = no #flags = REUSE port = 390 socket_type = stream wait = no user = nobody server = /usr/sbin/stunnel server_args = /etc/stunnel/ldap.conf # log_on_failure += USERID } Heres the stunnel configuration file (/etc/stunnel/ldap.conf): client = yes connect = 636 Cheers, Alex Forrow

1 0

Stunnel without certificates
by Shane 04 Aug '06

04 Aug '06

Hi, I am new to this group and also to Stunnel utility. I would like to use Stunnel to secure my http connections. Here is a twist. I just want to encrypt the link and don't bother much about the authentication. 1. Can I use Stunnel without certificates? 2. If certificate is mandatory, can I use only the file which contains "keys" but not use other authentication credentials? 3. Can I use anonymous DH Ciphers so that authentication phase is assumed done and both client and servers generate the keys? Any help and guidance will useful. Thanks, -Ravi Joshi __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

TIMEOUTbusy
by Martin Beauchamp 02 Aug '06

02 Aug '06

Hi List, I'm running Stunnel 4.15 under win32 in client mode. Can someone give me a better idea about what TIMEOUTbusy does? The docs state that it is "time to wait for expected data." But what does Stunnel do after this period? Does it disconnect from the remote server? Does it attempt another SSL session after some interval? Thanks for any addition information! Martin -- Martín Beauchamp Systems Engineer Park Slope Food Coop, Inc. (718) 783-2187 (718) 622-5685 Fax

1 0

stunnel crashing on connect
by Kevin King 24 Jul '06

24 Jul '06

Hi, I am attempting to run stunnel on Windows XP Pro but it is crashing as soon as anything connects to it. I am using it to create a secure TLS tunnel in front of an SMTP mail server and from what I read I should be able to do this and stunnel will handle the STARTLS commands. I downloaded the following windows binary: 562589 Mar 11 13:02:35 2006 stunnel-4.15-installer.exe I made minimal changes to stunnel.conf: 1) added the line "protocol = smtp" 2) uncommented the debug lines (still crashes if I leave these lines alone) I then start stunnel, either as a service or from cmd line - same thing happens >From a command prompt I then "telnet localhost 465" and send "EHLO mydomain.com hi" Stunnel responds with "250-EHLO mydomain.com hi Welcome". I am also running hMailServer on the same machine listening on port 25. It looks like stunnel is forwarded the initial EHLO to hMailServer, then hMailServer responds correctly and stunnel forwards that response back to me. Then stunnel crashes immediatly. Following is the log: 2006.07.20 10:28:41 LOG7[112:1656]: RAND_status claims sufficient entropy for the PRNG 2006.07.20 10:28:41 LOG6[112:1656]: PRNG seeded successfully 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service pop3s 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service imaps 2006.07.20 10:28:41 LOG7[112:1656]: Certificate: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: Key file: stunnel.pem 2006.07.20 10:28:41 LOG7[112:1656]: SSL context initialized for service ssmtp 2006.07.20 10:28:41 LOG5[112:1656]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.07.20 10:28:41 LOG5[112:1656]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.07.20 10:28:41 LOG5[112:2564]: No limit detected for the number of clients 2006.07.20 10:28:41 LOG7[112:2564]: FD 1884 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: pop3s bound to 0.0.0.0:995 2006.07.20 10:28:41 LOG7[112:2564]: FD 1872 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: imaps bound to 0.0.0.0:993 2006.07.20 10:28:41 LOG7[112:2564]: FD 1864 in non-blocking mode 2006.07.20 10:28:41 LOG7[112:2564]: SO_REUSEADDR option set on accept socket 2006.07.20 10:28:41 LOG7[112:2564]: ssmtp bound to 0.0.0.0:465 2006.07.20 10:28:59 LOG7[112:2564]: ssmtp accepted FD=1840 from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2564]: Creating a new thread 2006.07.20 10:28:59 LOG7[112:2564]: New thread created 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp started 2006.07.20 10:28:59 LOG7[112:2936]: FD 1840 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on local socket 2006.07.20 10:28:59 LOG5[112:2936]: ssmtp connected from 127.0.0.1:1543 2006.07.20 10:28:59 LOG7[112:2936]: FD 1812 in non-blocking mode 2006.07.20 10:28:59 LOG7[112:2936]: ssmtp connecting 127.0.0.1:25 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: waiting 10 seconds 2006.07.20 10:28:59 LOG7[112:2936]: connect_wait: connected 2006.07.20 10:28:59 LOG7[112:2936]: Remote FD=1812 initialized 2006.07.20 10:28:59 LOG7[112:2936]: TCP_NODELAY option set on remote socket 2006.07.20 10:28:59 LOG5[112:2936]: Negotiations for smtp (server side) started 2006.07.20 10:28:59 LOG7[112:2936]: RFC 2487 detected 2006.07.20 10:28:59 LOG7[112:2936]: <- 220 hmailserver ESMTP 2006.07.20 10:28:59 LOG7[112:2936]: -> 220220 hmailserver ESMTP + stunnel 2006.07.20 10:29:09 LOG7[112:2936]: <- EHLO mydomain.com hi 2006.07.20 10:29:09 LOG7[112:2936]: -> 250-EHLO mydomain.com hi Welcome Here is the output of stunnel -version: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none 2006.07.20 10:25:04 LOG3[3256:3456]: Server is down I tried building the source and debugging it but I only found some batch files refering to the MS embedded compiler. Why would I want to compile this for an embedded or mobile device? That is what that compiler is for. What makefile or compiler should I be using on windows if I wish to build stunnel on windows? Which I would rather not have to do, I would like to just use the binary but it is crashing before I ever get a chance to test it. Any help would greatly be appreciated. thanks, -Kevin

1 0

stunnel version issue?
by NobbyNoMates 22 Jul '06

22 Jul '06

Dear all - I am trying to set up an stunnel connection on an Ubuntu Dapper box. This system seems to give me (stunnel -V) : stunnel 3.26 on i486-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 and no matter where I look. I cannot seem to find an option to specify a config file when starting stunnel. Unfortunately, the instructions which I have received for setting up my (Direct Connect) client, contain such a config file which is supposed to be needed. It contains the following: client = yes delay = yes output = stunnel.log debug = notice pid = stunnel.pid [DC Server] connect = server.address.org:AAAAA accept = 127.0.0.1:BBBBB where of course the AAAA and BBBB are port numbers. Now I wonder if there is any way to make my stunnel version function in the specified way without the config file? Or is there some alternative way to specify this kind of config? Any suggestion would be much appreciated! Best regards, Erik

2 2

Clearer and Detailed version of the mail Stunnel for HTTP encription
by LoopBack Inc 20 Jul '06

20 Jul '06

Hello. I rewrote some parts of the question, and illustrated it by a small ASCII picture to clearifiy the whole situation. I don't know why I haven't got a single answer, because over 350 people are subscribed to the list, so I hope that I'll get some help now. It would be grateful. I use SocksCap to forward the iexplore cnnections to another port, a port on which stunnel listens. On PC1, the client, stunnel is listening on port 500. So when I start iexplore.exe with SocksCap every connection goes to 127.0.0.1:500. PC1 connects to PC2, with connect = 192.168.0.2:123 On PC2, the server, stunnel listens on port 500. then is connects to the internet with connect = 127.0.0.1:80. Here is the problem, stunnel doesn't connect to the internet over 127.0.0.1:80. I don't know why, but it doesnt. ---Stunnel.conf SERVER--- .. [inet] accept = 127.0.0.1:123 connect = 127.0.0.1:80 ---Stunnel.conf CLIENT--- .. [inet] accept = 127.0.0.1:500 connect = 192.168.0.2:123 LOGs from the SERVER: 2006.07.18 16:56:07 LOG7[2332:2720]: inet accepted FD=208 from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:2720]: Creating a new thread 2006.07.18 16:56:07 LOG7[2332:2720]: New thread created 2006.07.18 16:56:07 LOG7[2332:1880]: inet started 2006.07.18 16:56:07 LOG7[2332:1880]: FD 208 in non-blocking mode 2006.07.18 16:56:07 LOG5[2332:1880]: inet connected from 192.168.0.1:2156 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): before/accept initialization 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read client hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write server hello A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write change cipher spec A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 write finished A 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 flush data 2006.07.18 16:56:07 LOG7[2332:1880]: SSL state (accept): SSLv3 read finished A 2006.07.18 16:56:07 LOG7[2332:1880]: 1 items in the session cache 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects (SSL_connect()) 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 client renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects (SSL_accept()) 2006.07.18 16:56:07 LOG7[2332:1880]: 7 server connects that finished 2006.07.18 16:56:07 LOG7[2332:1880]: 0 server renegotiations requested 2006.07.18 16:56:07 LOG7[2332:1880]: 5 session cache hits 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache misses 2006.07.18 16:56:07 LOG7[2332:1880]: 1 session cache timeouts 2006.07.18 16:56:07 LOG6[2332:1880]: SSL accepted: previous session reused 2006.07.18 16:56:07 LOG7[2332:1880]: FD 244 in non-blocking mode 2006.07.18 16:56:07 LOG7[2332:1880]: inet connecting 127.0.0.1:80 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: waiting 10 seconds 2006.07.18 16:56:07 LOG7[2332:1880]: connect_wait: connected 2006.07.18 16:56:07 LOG7[2332:1880]: Remote FD=244 initialized After nothing happend for 52 seconds I aborted in the iexplore.exe to open the page. 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (read): warning: close notify 2006.07.18 16:56:59 LOG7[2332:1880]: SSL closed on SSL_read 2006.07.18 16:56:59 LOG7[2332:1880]: Socket write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL write shutdown 2006.07.18 16:56:59 LOG7[2332:1880]: SSL alert (write): warning: close notify 2006.07.18 16:56:59 LOG6[2332:1880]: SSL_shutdown successfully sent close_notify 2006.07.18 16:56:59 LOG5[2332:1880]: Connection closed: 0 bytes sent to SSL, 3 bytes sent to socket 2006.07.18 16:56:59 LOG7[2332:1880]: inet finished (0 left) LOGs from the CLIENT: 2006.07.18 17:10:11 LOG7[1756:4756]: inet accepted FD=444 from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:4756]: Creating a new thread 2006.07.18 17:10:11 LOG7[1756:4756]: New thread created 2006.07.18 17:10:11 LOG7[1756:2840]: inet started 2006.07.18 17:10:11 LOG7[1756:2840]: FD 444 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on local socket 2006.07.18 17:10:11 LOG5[1756:2840]: inet connected from 127.0.0.1:2284 2006.07.18 17:10:11 LOG7[1756:2840]: FD 348 in non-blocking mode 2006.07.18 17:10:11 LOG7[1756:2840]: inet connecting 192.168.0.2:123 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: waiting 10 seconds 2006.07.18 17:10:11 LOG7[1756:2840]: connect_wait: connected 2006.07.18 17:10:11 LOG7[1756:2840]: Remote FD=348 initialized 2006.07.18 17:10:11 LOG7[1756:2840]: TCP_NODELAY option set on remote socket 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): before/connect initialization 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write client hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read server hello A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 read finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write change cipher spec A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 write finished A 2006.07.18 17:10:11 LOG7[1756:2840]: SSL state (connect): SSLv3 flush data 2006.07.18 17:10:11 LOG7[1756:2840]: 17 items in the session cache 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects (SSL_connect()) 2006.07.18 17:10:11 LOG7[1756:2840]: 65 client connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 client renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects (SSL_accept()) 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server connects that finished 2006.07.18 17:10:11 LOG7[1756:2840]: 0 server renegotiations requested 2006.07.18 17:10:11 LOG7[1756:2840]: 48 session cache hits 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache misses 2006.07.18 17:10:11 LOG7[1756:2840]: 0 session cache timeouts 2006.07.18 17:10:11 LOG6[1756:2840]: SSL connected: previous session reused Nothing happendend, I aborted iexplore.exe 2006.07.18 17:10:25 LOG7[1756:2840]: Socket closed on read 2006.07.18 17:10:25 LOG7[1756:2840]: SSL write shutdown 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (write): warning: close notify 2006.07.18 17:10:25 LOG7[1756:2840]: SSL_shutdown retrying 2006.07.18 17:10:25 LOG7[1756:2840]: SSL doesn't need to read or write 2006.07.18 17:10:25 LOG7[1756:2840]: SSL alert (read): warning: close notify 2006.07.18 17:10:26 LOG7[1756:2840]: SSL closed on SSL_read 2006.07.18 17:10:26 LOG7[1756:2840]: Socket write shutdown 2006.07.18 17:10:26 LOG5[1756:2840]: Connection closed: 3 bytes sent to SSL, 0 bytes sent to socket 2006.07.18 17:10:26 LOG7[1756:2840]: inet finished (0 left) So the problem is that stunnel doesn't connect to the internet on PC2. I think i have to use something different than connect = 127.0.0.1:80 on PC2, but not sure. The version of stunnel is 4.15 I'm using Windows. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

4 3