- stunnel-users - stunnel.org

RE: [stunnel-users] Stunnel configuration
by Moehrke, John (GE Healthcare) 09 May '06

09 May '06

I would further like to ask: Is it true that the proper way to get to TLSv1 is to start with SSLv3? Is there a reference that someone can point me at? John _____ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Nadav, Erez Sent: Monday, May 08, 2006 11:55 AM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Stunnel configuration Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> ________________________________________________________________________ __________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Trying to load stunnel sources
by Nadav, Erez 09 May '06

09 May '06

Hi all, I am a programmer and I want to compile the stunnel for windows application in order to try to fix some non working TLS issues. I having problem when accessing http://www.stunnel.org/download/source.html address. I have the following questions: 1. Where and How can I load all stunnel sources ? 2. How should I compile it on windows machine ? 3. How should I use the mentioned PGP key Thanks Erez __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

Stunnel configuration
by Nadav, Erez 08 May '06

08 May '06

Hi all, How can I configure my stunnel client application (windows) with the following parameter : TLSv1only = yes Nadav Erez R&D Verint Systems Ltd. Phone: +972-9-962-4753 Cell: +972-54-778-4753 Email: erez.nadav(a)verint.com <mailto:[email protected]@verint.com> Web: www.verint.com <http://www.verint.com/> __________________________________________________________________________________________ This electronic message contains information from Verint Systems, which may be privileged and confidential. The information is intended to be for the use of the individual(s)or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by replying to this email (1).

1 0

client certificate authentication
by Srilalitha Muralidhara(HCL Capital Market Services) 08 May '06

08 May '06

Hi, I am new to stunnel. My application listens on 6 socket ports. External applications either dump data on these socket ports or send requests on these socket ports to receive data. Thus, my application is a server and external applications are clients. We got to authenticate these external applications before accepting the requests/data. So I am planning to use client certificate authentication of stunnel. In this case, should the server have a certificate as well? Will the server be authenticated? Is it necessary for all the external applications to be using the same certificate? Thanks, Sri Disclaimer: *********** The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of HCL Capital Market Services and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of HCL Capital Market Services. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and HCL Capital Market Services is not responsible for any loss or damage arising in any way from its use.

1 0

Performance Problems.
by Don Werve 05 May '06

05 May '06

After a fair bit of poking, prodding, and googling, I have yet to find the solution to my problem. So, here goes: stunnel looks to be running slowly. Very slowly. We're starting to analyze it with gprof to see where it spends all of its time when we're trying to do content negotiation, and I've whipped up a quick-and-dirty Ruby script that grabs data from the server and then spits out the performace results; I'm sitting on my own T1, so our connectivity is pretty good. The results with this script are similar with 'delay=yes', 'session=600', and 'compression=zlib'. So, here's what happens when I nab data from our stunnel-ed server with said script (I can supply the script if anyone is interested): #File Size time thrpht time thrprt multiple ---------------------------------------------------------------------- index.html 7k http 0.1548 ( 46k/s) https 0.7449 ( 9k/s) * 4.8131 test1.jpg 1k http 0.0928 ( 12k/s) https 0.6379 ( 1k/s) * 6.8726 test2.jpg 10k http 0.1812 ( 59k/s) https 0.6743 ( 16k/s) * 3.7208 test3.jpg 19k http 0.2236 ( 85k/s) https 0.7677 ( 24k/s) * 3.4338 test4.jpg 53k http 0.5668 ( 94k/s) https 1.1543 ( 46k/s) * 2.0365 test5.jpg 97k http 0.7861 (123k/s) https 2.1974 ( 44k/s) * 2.7954 test6.jpg 214k http 1.4061 (152k/s) https 2.3735 ( 90k/s) * 1.6880 test7.jpg 140k http 0.9434 (149k/s) https 1.9331 ( 72k/s) * 2.0491 test8.jpg 470k http 2.8590 (164k/s) https 3.7696 (124k/s) * 1.3185 ('multiple' is the number of times 'slower' https is versus http). And, here's my stunnel config: *** cert = /etc/certs/combined.pem setuid = nobody setgid = nobody pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 0 output = /var/log/stunnel [https] local = 64.40.110.16 accept = 443 connect = 64.40.110.16:80 TIMEOUTclose = 0 *** So, any ideas why stunnel is working so slowly? I mean, I know there's the overhead of the SSL negotiation, and I've heard some things about a stunnel session cache, but nothing about enabling/using it (unless 'session = something bigger than zero' does so?). Any suggestions to improve performance, especially for large batches of small transfers? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 05 May '06

05 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com). In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

2 1

Using stunnel to add https support to ONE virtual host
by Gonzalo Diethelm 04 May '06

04 May '06

Hello, I have Apache serving plain http pages for several domains running as virtual hosts on one machine (debian). I know SSL will not work with this setup, and I understand the reasons why (at least I think I do). Let's say the virtual hosts are www.server1.com www.server2.com www.server3.com I would like to use stunnel to add https capabilities to ONE of the virtual hosts (say, www.server3.com). In other words, I would like to configure stunnel in server mode with a certificate file, listening on www.server3.com:443, so that if I use a browser to visit https://www.server3.com/ then stunnel will accept the connection and forward all traffic to www.server3.com:80, letting Apache handle it; in particular, this would have to allow Apache to recognize which of the virtual hosts is being visited; I wouldn't like to have www.server1.com respond to my requests instead of www.server3.com. Is this possible? Any caveats, hints, recommendations? Thanks in advance, and best regards, -- Gonzalo Diethelm gonzalo.diethelm(a)aditiva.com

1 0

Re: stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel-users, @Michal Trojnara: Thanks for your help, Mike! The solution came overnight when i remembered my own message: > and the screen on the server side should remove the background image > and visual effects). Well: I disabled the desktop modifications in vnc and it runs. Something is incompatible in the stunnel GUI with the removal of global windows GUI behaviour (despite the fact, that i have not a single one of them in use - to the best of my knowledge), what has nothing to do with the dedication of stunnel. Maybe there's a simple GUI message not handled correctly? As this seems to be something common to all windows versions, could this possibly happen in windows xp, too? (I don't use one, so somone would have to investigate this.) It's another motivation to start compiling in cygnus. But unfortunally at this very moment i'm occupied with other tasks. May be some other guy has the fancy to look at this matter... Mit freundlichem Gruß Harry Boeck

1 0

stunnel install issues with mknod command
by Trishul Shah 04 May '06

04 May '06

Hi, I was wondering if you could help me, I am trying to install stunnel on a machine running solaris 10, but the catch is that I am trying to install it within a zone in solaris 10, unfortunately during the installation process after the source is compiled I see the following error: Making install in src test -z "/usr/local/lib" || /bin/bash ../auto/mkinstalldirs "/usr/local/lib" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'libstunnel.la' '/usr/local/lib/libstunnel.la' ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/libstunnel.so chmod +x /usr/local/lib/libstunnel.so ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" /bin/bash ../libtool --mode=install ../auto/install-sh -c 'stunnel' '/usr/local/sbin/stunnel' ../auto/install-sh -c stunnel /usr/local/sbin/stunnel test -z "/usr/local/sbin" || /bin/bash ../auto/mkinstalldirs "/usr/local/sbin" ../auto/install-sh -c 'stunnel3' '/usr/local/sbin/stunnel3' Making install in doc test -z "/usr/local/share/doc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html' ../auto/install-sh -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html' ../auto/install-sh -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html' test -z "/usr/local/man/man8" || /bin/bash ../auto/mkinstalldirs "/usr/local/man/man8" ../auto/install-sh -c -m 644 './stunnel.8' '/usr/local/man/man8/stunnel.8' ../auto/install-sh -c -m 644 './stunnel.pl.8' '/usr/local/man/man8/stunnel.pl.8' ../auto/install-sh -c -m 644 './stunnel.fr.8' '/usr/local/man/man8/stunnel.fr.8' Making install in tools test -z "/usr/local/etc/stunnel" || /bin/bash ../auto/mkinstalldirs "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 'stunnel.conf-sample' '/usr/local/etc/stunnel/stunnel.conf-sample' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/bin/openssl req -new -x509 -days 365 -nodes $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ test -eq 0 || /usr/local/bin/openssl gendh $RND 512 >> stunnel.pem; \ /usr/local/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi mkdir -p /usr/local/var/stunnel chmod a=rwx,+t /usr/local/var/stunnel if uname | grep SunOS; then \ mkdir -p /usr/local/var/stunnel/dev; \ chmod u=rwx,go=rx /usr/local/var/stunnel/dev; \ mknod /usr/local/var/stunnel/dev/zero c 13 12; \ chmod a=rw /usr/local/var/stunnel/dev/zero; \ fi SunOS mknod: Not owner *** Error code 2 make: Fatal error: Command failed for target `install-data-local' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /export/home/playtech/stunnel-4.14/tools *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' After much digging around I have discovered that the mknod command cannot be used within a solaris 10 zone, I have gotten round this previously by installing stunnel from the global zone but that intertwines the parent zone with the child zone and ideally we would like to keep these as independent of each other as possible as we use these zones for 3rs party applications and hence we have a lot of other user traffic on these zones. Thanks in advance for your help. Kind Regards, Trishul Shah Blue Square Tel: 020 7288 7920 Mob: 07789 982 688 Fax: 020 7288 7955

1 0

stunnel 4.15 crashes with vnc server 4.1.1
by Harry Boeck 04 May '06

04 May '06

Hallo stunnel users, i'm learning to use ssl and ssh tools to get secured access to my home server from work and other places. I already have a working ssh installation but stumbled over stunnel ba accident. I would like to use it, because i still have computers in use with win98 (both for myself and among my clients) and this little program is exactly all what i would need to use vnc over a secured connection. SSH to the contrary needs a little bit more setup (over a cygwin that serves the only purpose of aquiring such tools like SSH), needs its own crypto library compilation and so on. Now, there is the problem that stunnel 4.15 crashes at the moment, when the vnc server 4.1.1 tries to deliver its first screen to the client. Stunnel was downloaded from http://www.stunnel.org/download/binaries.html, vnc was downloaded from http://www.realvnc.com (already some times ago). Both where downloaded as binaries, for the typical help hints on forums for the question "i have a compile problem on windows" being "how dare you"... Both machines i'm using for testing use win98 as operating system. The crash happens both when testing a configuration on one machine with stunnel running both as server and as client, as well as when using it to connect two machines with stunnel running as server on the machine with vnc server and as client on the machine with vnc client. VNC runs correct for itself as well as via an ssh secured connection. Stunnel is startet with only the server versus the client configuration file as command line parameter. The configuration files are: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.ini http://harryboeck.dyndns.org/Sicherheit/stunnel-client.ini Stunnel delivers correctly the data between vnc server and client (including connection establishment and authentication) until the point of first screen transfer (when the screen on the client side turns black and the screen on the server side should remove the background image and visual effects). The output of stunnel server and client is: http://harryboeck.dyndns.org/Sicherheit/stunnel-server.log http://harryboeck.dyndns.org/Sicherheit/stunnel-client.log The output of "stunnel -version" is: http://harryboeck.dyndns.org/Sicherheit/stunnel-version.txt I have no clue what '6. Output of "uname -a"' should mean, if that is somehow important for hints, please let me know. openssl version is: OpenSSL 0.9.8a 11 Oct 2005 I would appreciate any suggestions or hints on the interaction of vnc and stunnel. with best regards Harry Boeck

2 1

certificate unknown
by Ludovic DUFLOT 03 May '06

03 May '06

Hi, I tried to use stunnel to connect in SSL to a LDAP server. But I can't and I've got this error message: certificate unknown I use stunnel for establishing connexion with IMAPS server and all is right but not for LDAP connexion. The certificate is self-signate. I searched on the list's archives and with google but I can't find any solution... Help !!! Ludo ps: these are the stunnel.conf and the log: *************************** cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ldaps] accept = 389 connect = 10.0.0.1:636 verify = 0 [imaps] accept = 143 connect = 10.0.0.2:993 *************************** 2006.05.03 07:52:40 LOG7[4436:2436]: RAND_status claims sufficient entropy for the PRNG 2006.05.03 07:52:40 LOG6[4436:2436]: PRNG seeded successfully 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service ldaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service imaps 2006.05.03 07:52:40 LOG7[4436:2436]: Certificate: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: Key file: stunnel.pem 2006.05.03 07:52:40 LOG7[4436:2436]: SSL context initialized for service https 2006.05.03 07:52:40 LOG5[4436:2436]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7f 22 Mar 2005 2006.05.03 07:52:40 LOG5[4436:2436]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.05.03 07:52:40 LOG5[4436:4612]: No limit detected for the number of clients 2006.05.03 07:52:40 LOG7[4436:4612]: FD 192 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: ldaps bound to 0.0.0.0:389 2006.05.03 07:52:40 LOG7[4436:4612]: FD 196 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: imaps bound to 0.0.0.0:143 2006.05.03 07:52:40 LOG7[4436:4612]: FD 212 in non-blocking mode 2006.05.03 07:52:40 LOG7[4436:4612]: SO_REUSEADDR option set on accept socket 2006.05.03 07:52:40 LOG7[4436:4612]: https bound to 0.0.0.0:443 2006.05.03 07:52:50 LOG7[4436:4612]: ldaps accepted FD=220 from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:4612]: Creating a new thread 2006.05.03 07:52:50 LOG7[4436:4612]: New thread created 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps started 2006.05.03 07:52:50 LOG7[4436:5780]: FD 220 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on local socket 2006.05.03 07:52:50 LOG5[4436:5780]: ldaps connected from 127.0.0.1:2893 2006.05.03 07:52:50 LOG7[4436:5780]: FD 244 in non-blocking mode 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps connecting 10.0.0.1:636 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: waiting 10 seconds 2006.05.03 07:52:50 LOG7[4436:5780]: connect_wait: connected 2006.05.03 07:52:50 LOG7[4436:5780]: Remote FD=244 initialized 2006.05.03 07:52:50 LOG7[4436:5780]: TCP_NODELAY option set on remote socket 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): before/connect initialization 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client hello A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server hello A 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=1, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=DSI CA/emailAddress=admin(a)univ-savoie.fr 2006.05.03 07:52:50 LOG5[4436:5780]: VERIFY IGNORE: depth=0, /C=FR/ST=Savoie/L=Chambery/O=Universite de Savoie/OU=DSI/CN=ldap-bourget.univ-savoie.fr 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server certificate request A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 read server done A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client certificate A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write client key exchange A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write certificate verify A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write change cipher spec A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 write finished A 2006.05.03 07:52:50 LOG7[4436:5780]: SSL state (connect): SSLv3 flush data 2006.05.03 07:52:50 LOG7[4436:5780]: SSL alert (read): fatal: certificate unknown 2006.05.03 07:52:50 LOG3[4436:5780]: SSL_connect: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2006.05.03 07:52:50 LOG5[4436:5780]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.05.03 07:52:50 LOG7[4436:5780]: ldaps finished (0 left)

1 0

Wrapping interclient connections outbound to many servers
by Matthew Case 02 May '06

02 May '06

Hello all, I have searched high and low for a solution to this problem, but I haven't found anything so I am coming here in hopes someone will be able to help me. I have to wrap the interclient protocol (>1024 to 3060) in some manner of encryption to appease one of my clients. I have already wrapped the ajp13 protocol between the apache server and the tomcat server, but now the tomcat server (which acts as an stunnel server in the ajp13 setup) must also act as a client and wrap all outbound and return traffic to 10 servers to and from port 3060. Making large modifications to the source code is not going to be feasible given my current time crunch (it must be implemented in two weeks). Has anyone run into anything like this and does anyone have any tips? Thanks in advance! - Matt

1 0

Stunnel + Snort + MySQL
by Steven 02 May '06

02 May '06

I have a problem that I have been unsuccessful in solve thus far with Stunnel, Snort, and MySQL. Stunnel (client & server): 4.04 Snort: 2.4.4 on the client MySQL Ver 11.18 Distrib 3.23.58, for redhat-linux-gnu (i386) [not the latest and greatest by any means] I setup stunnel so that traffic destined for localhost 3306 (mysql) on the client goes to port 3307 on the server. Stunnel on the server is setup to take traffic from 3307 and send it to 3306 locally. This connection works fine. I can fire up Snort and have events properly log to my snort database on the server from the client. However, if stunnel is stopped/restarted on either the client or the server Snort is not able to keep writing to the database unless it is restarted. I just get this error: May 2 12:44:03 box snort[44126]: database: Problem inserting a new signature 'Test Snort Signature' May 2 12:44:03 box1 snort[44126]: database: mysql_error: MySQL server has gone away SQL=INSERT INTO event (sid,cid,signature,timestamp) VALUES ('4', '22', '0', '2006-05-02 16:44:03.322') May 2 12:44:03 box snort[44126]: database: mysql_error: MySQL server has gone away SQL=ROLLBACK Whenever I close stunnel it sends traffic to the other end. I can restart it and open up new connections just fine. However, Snort will not even try and connect to port 3306. Once stunnel has been stopped (or even restarted) it just immediately fails to even try and connect to the port. It seems there's some kind of signal sent that kills the connection (and all future connections?). I cannot figure oout why this happens. Any ideas? Thanks Steven

1 0

stunnel broken?
by Smith, Brian C1 (N-ASGARD AVIONICS) 28 Apr '06

28 Apr '06

does anyone know what this error message means and how to fix it? SSL_read (SSL_ERROR_SYSCALL): Operation would block (246) Brian Smith brian.c1.smith(a)lmco.com

1 0

SSL_read (SSL_ERROR_SYSCALL): Operation would block (246)
by Smith, Brian C1 (N-ASGARD AVIONICS) 26 Apr '06

26 Apr '06

Hello all, I am having a problem using stunnel to connect web application in java to a UniData Database server. The setup is working fine, traffic passes over the tunnel from webserver to database without a problem except when a large query is sent over the tunnel. Normal queries get responses no problem. I am running HP-UX 11.00. Stunnel is running in daemon mode on both servers. Any ideas why this might happen? Is there a buffer limit or something for stunnel? Thanks in advance! Here's the stunnel.conf files for them: database side: ------------------------------------------------------ RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd pid = /opt/hpws/apache/logs/stunnel.pid debug = 7 output = /opt/hpws/apache/logs/stunnel.log client = no foreground = no [unidata] accept = 5555 connect = 127.0.0.1:31438 ------------------------------------------------------ webserver side: ------------------------------------------------------ RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd pid = /opt/hpws/apache/logs/stunnel.pid debug = 7 output = /opt/hpws/apache/logs/stunnel.log client = yes foreground = no [unidata] accept = 127.0.0.1:5555 connect = dbserver:5555 ------------------------------------------------------ Here is my stunnel -version output: ------------------------------------------------------ stunnel 4.04 on hppa2.0w-hp-hpux11.00 PTHREAD with OpenSSL 0.9.7g 11 Apr 2005 Global options cert = /opt/hpws/apache/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds ------------------------------------------------------ Here is the error from the client: ------------------------------------------------------ 2006.04.26 10:47:11 LOG7[1862:1]: unidata accepted FD=0 from 127.0.0.1:49644 2006.04.26 10:47:11 LOG7[1862:1]: FD 0 in non-blocking mode 2006.04.26 10:47:11 LOG7[1862:8]: unidata started 2006.04.26 10:47:11 LOG5[1862:8]: unidata connected from 127.0.0.1:49644 2006.04.26 10:47:11 LOG7[1862:8]: FD 1 in non-blocking mode 2006.04.26 10:47:11 LOG7[1862:8]: unidata connecting 141.240.76.34:5555 2006.04.26 10:47:11 LOG7[1862:8]: remote connect #1: EINPROGRESS: retrying 2006.04.26 10:47:11 LOG7[1862:8]: waitforsocket: FD=1, DIR=write 2006.04.26 10:47:11 LOG7[1862:8]: waitforsocket: ok 2006.04.26 10:47:11 LOG7[1862:8]: Remote FD=1 initialized 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): before/connect initialization 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write client hello A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server hello A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server certificate A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read server done A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write client key exchange A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write change cipher spec A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 write finished A 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 flush data 2006.04.26 10:47:11 LOG7[1862:8]: SSL state (connect): SSLv3 read finished A 2006.04.26 10:47:11 LOG7[1862:8]: 3 items in the session cache 2006.04.26 10:47:11 LOG7[1862:8]: 7 client connects (SSL_connect()) 2006.04.26 10:47:11 LOG7[1862:8]: 7 client connects that finished 2006.04.26 10:47:11 LOG7[1862:8]: 0 client renegotiatations requested 2006.04.26 10:47:11 LOG7[1862:8]: 0 server connects (SSL_accept()) 2006.04.26 10:47:11 LOG7[1862:8]: 0 server connects that finished 2006.04.26 10:47:11 LOG7[1862:8]: 0 server renegotiatiations requested 2006.04.26 10:47:11 LOG7[1862:8]: 4 session cache hits 2006.04.26 10:47:11 LOG7[1862:8]: 0 session cache misses 2006.04.26 10:47:11 LOG7[1862:8]: 0 session cache timeouts 2006.04.26 10:47:11 LOG6[1862:8]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.04.26 10:47:12 LOG3[1862:8]: SSL_read (SSL_ERROR_SYSCALL): Operation would block (246) 2006.04.26 10:47:12 LOG5[1862:8]: Connection reset: 744 bytes sent to SSL, 539 bytes sent to socket 2006.04.26 10:47:12 LOG7[1862:8]: unidata finished (0 left) --------------------------------------------------------- Here is the error from the server: --------------------------------------------------------- 2006.04.26 10:48:24 LOG7[18850:1]: unidata accepted FD=0 from 141.240.76.29:49645 2006.04.26 10:48:24 LOG7[18850:1]: FD 0 in non-blocking mode 2006.04.26 10:48:24 LOG7[18850:6]: unidata started 2006.04.26 10:48:24 LOG5[18850:6]: unidata connected from 141.240.76.29:49645 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): before/accept initialization 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read client hello A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write server hello A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write certificate A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write server done A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 flush data 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read client key exchange A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 read finished A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write change cipher spec A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 write finished A 2006.04.26 10:48:24 LOG7[18850:6]: SSL state (accept): SSLv3 flush data 2006.04.26 10:48:24 LOG7[18850:6]: 1 items in the session cache 2006.04.26 10:48:24 LOG7[18850:6]: 0 client connects (SSL_connect()) 2006.04.26 10:48:24 LOG7[18850:6]: 0 client connects that finished 2006.04.26 10:48:24 LOG7[18850:6]: 0 client renegotiatations requested 2006.04.26 10:48:24 LOG7[18850:6]: 5 server connects (SSL_accept()) 2006.04.26 10:48:24 LOG7[18850:6]: 5 server connects that finished 2006.04.26 10:48:24 LOG7[18850:6]: 0 server renegotiatiations requested 2006.04.26 10:48:24 LOG7[18850:6]: 3 session cache hits 2006.04.26 10:48:24 LOG7[18850:6]: 1 session cache misses 2006.04.26 10:48:24 LOG7[18850:6]: 1 session cache timeouts 2006.04.26 10:48:24 LOG6[18850:6]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.04.26 10:48:24 LOG7[18850:6]: FD 1 in non-blocking mode 2006.04.26 10:48:24 LOG7[18850:6]: unidata connecting 127.0.0.1:31438 2006.04.26 10:48:24 LOG7[18850:6]: Remote FD=1 initialized 2006.04.26 10:48:25 LOG3[18850:6]: SSL_read (SSL_ERROR_SYSCALL): Connection reset by peer (232) 2006.04.26 10:48:25 LOG5[18850:6]: Connection reset: 9477 bytes sent to SSL, 744 bytes sent to socket 2006.04.26 10:48:25 LOG7[18850:6]: unidata finished (0 left) ---------------------------------------------------------- Brian Smith brian.c1.smith(a)lmco.com

1 0

NSIS Installer Script
by Ryan O'Horo 25 Apr '06

25 Apr '06

I'm looking to distribute stunnel for Windows in such a manner that stunnel installs with a client certificate already configured. Is the original NSIS installer script available for use? Ryan O'Horo

2 1

New behaviour under 4.15?
by Scott Tuc Ellentuch＠T-B-O-H 24 Apr '06

24 Apr '06

Hi, I just did a portupgrade in FreeBSD from 4.14 to 4.15, and now it seems to be looping the command that I asked it, instead of just doing it once. Has there been an option added I need to tell it to just do once? Thanks, Tuc

3 2

too many file descriptors
by Sligar, Benjamin 22 Apr '06

22 Apr '06

I'm working on upgrading from stunnel 4.04 to the 4.15 to utilize the per port specification of a certificate. On my initial testing, I ran with only a few ports, specified the different certs, and, everything seems to work fine. I'm ran into a problem, though, when trying to use the same config file in regards to the number of configured ports. I have 104 inbound ports setup, and, when it hits the 69th configured port, I get the following message for this, and every port that follows: s_poll_add failed for FD=69: too many file descriptors I checked the code, and, this is what I found: #define MAX_FD 64 I didn't find a relation to any configurable options, so I made a change to this parameter in the code, recompiled, and, I was able to start up all of my listens without error. I just wanted to pass this along, and, if it does tie into a configurable parameter, my apologies for not finding it....if someone knows it, please pass that on. Thanks! **************************************** Benjamin Sligar Senior Development Support Specialist Transaction Network Services, Inc P: 703.453.8324 F: 703.453.8391 AIM: dagdromer88 **************************************** This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Stunnel with TPM engine !!!
by dinesh.kallath＠bt.com 19 Apr '06

19 Apr '06

Hello I am new to Stunnel and would like to know how to integrate the engine with Stunnel 4.15. I am trying to integrate a Trusted Platform Module (TPM) engine which is compatible with OpenSSL to use with Stunnel so that the private key for SSL connection can be retrieved and stored in the hardware. I was able to configure the Stunnel config file to use the engine and it is loading the engine fine. The problem I am facing now is the key which stunnel tries to load can be loaded only by the engine, I mean it has to be loaded into the TPM to use it and stunnel tried to load it in the normal way. Please find the debug output bellow, # ./stunnel stunnel-engine.conf 2006.04.19 13:39:22 LOG7[1261:3086812864]: Enabling support for engine 'tpm' DEBUG e_tpm_err.c:295 ERR_load_TPM_strings DEBUG e_tpm_err.c:298 TPM_lib_error_code is 136 2006.04.19 13:39:22 LOG7[1261:3086812864]: Initializing engine DEBUG e_tpm.c:336 tpm_engine_init LOG_DEBUG TSPI ../tcsd_api/clntside.c:58 Sending TSP packet to host localhost. LOG_DEBUG TSPI ../tcsd_api/clntside.c:74 Connecting to 127.0.0.1 LOG_DEBUG TSPI ../tcsd_api/tcstp.c:390 TCS_OpenContext_RPC_TP: Received TCS Context: 0xa0ef791d 2006.04.19 13:39:22 LOG7[1261:3086812864]: Engine initialized 2006.04.19 13:39:22 LOG7[1261:3086812864]: Engine closed 2006.04.19 13:39:22 LOG7[1261:3086812864]: Snagged 64 random bytes from /root/.rnd DEBUG e_tpm.c:1151 tpm_rand_bytes getting 1024 bytes LOG_DEBUG TSPI ../tcsd_api/tcstp.c:2488 TCSP_GetRandom_TP: TCS Context: 0xa0ef791d 2006.04.19 13:39:23 LOG7[1261:3086812864]: Wrote 1024 new random bytes to /root/.rnd DEBUG e_tpm.c:1171 tpm_rand_status 2006.04.19 13:39:23 LOG7[1261:3086812864]: RAND_status claims sufficient entropy for the PRNG 2006.04.19 13:39:23 LOG6[1261:3086812864]: PRNG seeded successfully DEBUG e_tpm.c:736 tpm_rsa_init 2006.04.19 13:39:23 LOG7[1261:3086812864]: Certificate: /root/dk/CVS/070406/applications/openssl_tpm_engine/TpmKey.crt 2006.04.19 13:39:23 LOG7[1261:3086812864]: Key file: /root/dk/CVS/070406/applications/openssl_tpm_engine/TpmKey.key 2006.04.19 13:39:23 LOG3[1261:3086812864]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2006.04.19 13:39:23 LOG3[1261:3086812864]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line It is obvious from the debug that the Stunnel expect a private key file in PEM format but the whole issue is that the private key I have (created using TPM) is not in a PEM format, it is an encrypted file with root key used to encrypt stays inside the TPM hardware. I suppose we need to provide a key load function which loads the key into the TPM rather than using Stunnel. It will be a great help if someone could provide me with some pointers on how to solve this, or please let me know if I am missing out something. Also do ask me if you need any further clarifications. Many thanks, Dinesh Kallath, CISSP Research Professional, Security Research Centre BT Group Chief Technology Office ___________________________ Tel : +44 (0) 1473 643476 Fax : +44 (0) 1473 646886 Mob: +44 (0) 7952144553 Email: dinesh.kallath(a)bt.com Post : PP:2A, B28, Adastral Park, Ipswich IP5 3RE. British Telecommunications plc Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no. 1800000 This electronic message contains information from British Telecommunications plc which may be privileged or confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by telephone or email (to the numbers or address above) immediately. Activity and use of the British Telecommunications plc email system is monitored to secure its effective operation and for other lawful business purposes. Communications using this system will also be monitored and may be recorded to secure effective operation and for other lawful business purposes.

1 0

stunnel-4.15 doesn't work on Mac OS X 10.4.6
by SUENAGA Hiroki 18 Apr '06

18 Apr '06

Dear all, I found a problem that the stunnel-4.15 doesn't work on the Mac OS X 10.4.6. I think this is a BUG. My environment is: - OS: Mac OS X 10.4.6/Intel - Compiler: gcc 4.0.1 (from XCode 2.2) - OpenSSL: 0.9.7i (Mac OS X original version) - Usage: connect to the submission port. The detail of BUG is the following: In protocol.c::smtp_client() line 138, fdputline() called with argument line = "EHLO localhost." This is a string literal. 130 static void smtp_client(CLI *c) { ... 138 fdputline(c, c->remote_fd.fd, "EHLO localhost"); ... In network.c::fdputline() line 565, the literal is passed to 1st argument of safeconcat(). 556 void fdputline(CLI *c, int fd, char *line) { .... 565 safeconcat(line, crlf); ... In common.h line 311, safeconcat() is #define'ed as: 311 #define safeconcat(dst, src) \ 312 (dst[STRLEN-1]='\0', strncat((dst), (src), \ STRLEN-strlen(dst)-1)) This means the macro safeconcat() write to string literal. This is the BUG. In Mac OS X envoronment, string literal is NOT writable. So protection fault occurs at this code. On the other environment, this breaks somewhere in the heap or in the stack. This may also cause a crash. In stunnel-4.14, fdprintf() is used instead of fdputline(). fdprint() have own writable buffers on stack, and the string literal is copied to the stack. This works fine. The work around is using own writable buffers in fdputline() like fdprint() in stunnel-4.14. But it seems to be a performance tuning why fdputline() is used. So I don't know what is the correct way to fix this BUG.... I hope this BUG is fixed in the future release. If this was already reported, please ignore this mail. Thank you. Rgards, ---------- Internet Initiative Japan Inc. Research & Development Section, Product Development Division, SEIL Business Unit SUENAGA Hiroki <hsuenaga(a)iij.ad.jp>

2 2

STunnel and the MAC
by Bryan Bearden 15 Apr '06

15 Apr '06

I am working on setting up a mac server and having trouble getting the stunnel to work on the mac. I installed Darwin Ports and am running it under there. It appears to be running and my stunnel.conf file appears to be correct, but I cannot get it to use stunnel. Any ideas? I'm trying to connect to MySQL 4. thanks... Bryan

1 0

Choosing local 'source' IP? (again)
by Don Werve 14 Apr '06

14 Apr '06

This is a repost, but the response I got last time said, 'use the "local" option'...which does not appear to work. Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. On the same piece of hardware that runs this service (Virtuozzo if you must know), I've set up stunnel to listen to ETH0_IP:443 and wrapper them to ETH0_IP:80, which is where VZ listens. This works wonderfully. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, save for by the IP address of the connection. Now, each piece of iron has two ethernet adapters, so I got the bright idea to try and get stunnel to 'appear' to be connecting from the IP address of the second adapter. So, I set 'local = ETH1_IP' in stunnel.conf, and...nada. Still shows as connecting from ETH0_IP. I've screwed with socket options, read the source code for Stunnel, and so on. Having read the source code and refreshed my knowledge of socket() and connect(), is it really even possible to do what I want if stunnel is running on the same system? Oh, a ptrace of stunnel also yields the following: socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 8 fcntl64(8, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0 bind(8, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("[ETH1_IP]")}, 16) = 0 connect(8, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("[ETH0_IP]")}, 16) = -1 EINPROGRESS (Operation now in progress) ...and the connection inside of $CRAP_SYSTEM shows the connection as coming from ETH0_IP. So, I'm kind of at my wits' end here. Any possible way to make this work? Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

stunnel4 stealing my ports (listening on ports it shouldn't be)
by Eric Brown 12 Apr '06

12 Apr '06

I have two stunnel processes. One listing on 443 -> localhost:80. The other listening on 8000 -> localhost:7001. (See configs below.) However, when I stop the process listening on port 7001, both stunnel processes start listening on 7001 (and a few other ports). I'm completely confused as to why this would happen. This is what I see normally: mta4-tiny-support (epgate)[6]$ sudo lsof -p 25253 -p 25255 -a -i4 Password: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 25253 root 6u IPv4 3439450 TCP *:8000 (LISTEN) stunnel4 25255 root 6u IPv4 3439456 TCP *:https (LISTEN) This is what I see when stunnel appears to go bizerk: (after stopping the process that was listening on ports *:7000, localhost:7001 & localhost:7005) COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME stunnel4 22788 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22788 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22788 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22788 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22788 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22788 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22788 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22788 root 24u IPv4 1275089 TCP *:8000 (LISTEN) stunnel4 22790 root 5u IPv4 1269640 TCP 127.0.0.1:4341- >127.0.0.1:19996 (CLOSE_WAIT) stunnel4 22790 root 6u IPv4 1273504 TCP 127.0.0.1:7001 (LISTEN) stunnel4 22790 root 7u IPv4 1273476 TCP 127.0.0.1:4606- >127.0.0.1:19995 (ESTABLISHED) stunnel4 22790 root 9u IPv4 1273477 TCP 127.0.0.1:19995- >127.0.0.1:4606 (ESTABLISHED) stunnel4 22790 root 11u IPv4 1273507 TCP *:7000 (LISTEN) stunnel4 22790 root 17u IPv4 1273515 TCP 127.0.0.1:7005 (LISTEN) stunnel4 22790 root 19u IPv4 1274895 TCP 127.0.0.1:7001- >127.0.0.1:1793 (CLOSE_WAIT) stunnel4 22790 root 24u IPv4 1275094 TCP *:443 (LISTEN) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.1:7008 0.0.0.0:* LISTEN 0 1281907 24848/python tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 0 1275089 22788/stunnel4 tcp 0 0 0.0.0.0:1025 0.0.0.0:* LISTEN 0 1681 - tcp 0 0 0.0.0.0:963 0.0.0.0:* LISTEN 0 1556 1205/rpc.statd tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 0 1238 986/portmap tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 0 1281911 24848/python tcp 0 0 127.0.0.1:7025 0.0.0.0:* LISTEN 0 1281130 24605/master tcp 0 0 127.0.0.1:7026 0.0.0.0:* LISTEN 0 1281542 24677/python tcp 0 0 0.0.0.0:818 0.0.0.0:* LISTEN 0 1356 1061/ypbind tcp 0 0 127.0.0.1:7027 0.0.0.0:* LISTEN 0 1281731 24777/python tcp 0 0 127.0.0.1:7028 0.0.0.0:* LISTEN 0 1281910 24848/python tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 1486 1195/sshd tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN 0 1273507 22788/stunnel4 tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 400 1269115 20559/postmaster tcp 0 0 172.16.80.213:25 0.0.0.0:* LISTEN 0 1281126 24605/master tcp 0 0 172.16.80.212:25 0.0.0.0:* LISTEN 0 1280994 24584/master tcp 0 0 127.0.0.1:7001 0.0.0.0:* LISTEN 0 1273504 22788/stunnel4 tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 0 1275094 22790/stunnel4 tcp 0 0 127.0.0.1:955 0.0.0.0:* LISTEN 0 1518 1201/famd tcp 0 0 127.0.0.1:7005 0.0.0.0:* LISTEN 0 1273515 22788/stunnel4 tcp 0 0 127.0.0.1:7006 0.0.0.0:* LISTEN 0 1281540 24677/python tcp 0 0 127.0.0.1:7007 0.0.0.0:* LISTEN 0 1281724 24777/python I'm running stunnel 4.09 on Debian 3.1/Linux 2.6 Kernel. My configurations are: pid=/var/run/epgate_admin_stunnel4.pid cert=/epgate/etc/ssl/admin.stunnel [Admin] accept=8000 connect=7001 and: pid=/var/run/epgate_quarantine_stunnel4.pid cert=/epgate/etc/ssl/quar.stunnel [Quarantine] accept=443 connect=80

1 0

Deamon signal on close connection
by Ondra Medek 05 Apr '06

05 Apr '06

Hi, I'm using stunnel4 in daemon mode. It runs a bash script "service" for each connection. I want to stop the script, when the client closes the connection. Does the stunnel4 send any signal to child process when the connection is closed? My script receives no signal. Or is it a problem of bash? The only way how can the script find, that connection is broken is by reading the standart input, but I don't want to read any standart input. Thanks P.S. a snip of stunnel4 config: [aswconsole] accept = 1002 exec = /home/ondrejm/SeptimOS/ServerConsole/aswc-new/opt/asw/console/service

1 0

Having problems with an special configuration
by Michael Spiegle 04 Apr '06

04 Apr '06

Hi all, I've got a strange thing (at least I think so) that i'm trying to do with stunnel and it doesn't work. Here's the layout... Feel free to skip the next 3 paragraphs to get to the root of the problem: I'm using stunnel to provide SSL for a set of webservers behind a pair of LVS loadbalancers using keepalived. lets say I have a public IP of 10.0.0.1. I have an iptables rule which marks all 443 traffic to this IP with a fwmark, then keepalived dumps the traffic to the stunnel after seeing this fwmark. I have configured LVS to use direct-routing so that the stunnel server can see the original public IP which was requested (so it can serve up the right cert). Now, here is where things break. Internally, lets say stun is setup with an IP 192.168.0.10, and the LVS server has an interface on this VLAN with the IP 192.168.0.5. In my keepalived configuration for the correct fwmark, I dump the traffic to stun on 192.168.0.10. When I test this by creating a connection to the public IP address (10.0.0.1), LVS dumps the traffic to stunnel as planned and stunnel sees something like the following in TCPDUMP: Websurfer's_IP:123131 ----> 10.0.0.1:443 Stunnel refuses to do anything with the traffic. I assumed this was becuase the IP 10.0.0.1 wasn't configured anywhere on the stunnel box itself. I assigned this IP to the loopback interface as an alias, and it still doesn't work. I've straced/debug-logged stunnel and it doesn't do anything - almost like it doesn't think it should service the traffic. If I run netstat - plan, stunnel is listening to 0.0.0.0:443. So, why doesn't stunnel want to do anything with this traffic? uname -a: Linux ssl-server.domain.com 2.4.29-1.2smp #1 SMP Fri Mar 18 15:45:07 EST 2005 i686 unknown Running redhat 7.3. Glibc: glibc-2.2.5-44 glibc-common-2.2.5-44 openssl version: 0.9.6b configuration: cert = /nfs/ssl/pem/default chroot = /nfs certdir = /ssl/pem hashdir = yes pid = /run/stunnel.pid setuid = nobody setgid = nogroup output = /var/log/stunnel.log [https] accept = 443 connect = *:80 httpprotocol = yes TIMEOUTclose = 1 IP on loopback: bash-2.05a# ip addr list 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo inet 10.0.0.1/32 brd 10.0.0.255 scope global lo:0 ... ... ... Michael Spiegle mike(a)nauticaltech.com 310.686.4570

1 0

(stunnel-4.14) poor performance with openssl engine
by Zhuang Yuyao 03 Apr '06

03 Apr '06

Hi, I've just added openssl engine support for Cavium Nitrox lite PCI card. Here are the speed test output: [engine] stands for speed test output with engine [soft] stands for speed test output without engine (openssl internal software implementation used) ~ # openssl speed -evp [rc4|aes256|sha1] [-engine /root/libcavium.so] ...... The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes rc4[engine] 6339.20k 25376.00k 100966.40k 3757056.00k 919961.60k rc4[soft] 6056.66k 7017.34k 7228.37k 7339.13k 7356.14k aes-256-cbc[engine] 3178.40k 25465.60k 50636.80k 194201.60k 2088140.80k aes-256-cbc[soft] 2430.36k 2572.93k 2597.45k 2617.27k 2609.82k sha1[engine] 774.20k 3115.20k 16486.40k 27033.60k 285593.60k sha1[soft] 915.74k 2622.71k 5678.93k 7942.23k 9041.75k ~ # openssl speed rsa [-engine /root/libcavium.so] sign verify sign/s verify/s rsa[soft] 512 bits 0.013810s 0.001349s 72.4 741.2 rsa[soft] 1024 bits 0.079200s 0.004342s 12.6 230.3 sign verify sign/s verify/s rsa[engine] 512 bits 0.000037s 0.000022s 26725.8 45181.5 rsa[engine] 1024 bits 0.000046s 0.000043s 21866.7 23489.1 The speed test shows than using engine is much much faster than software implementations. but while testing with stunnel, the result is really poor. I am still using apache benchmark 2 as the test tool. #ab2 -c 50 -n 100 https://192.168.10.5/test_1k.html (a html file whose size is 1Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_4k.html (a html file whose size is 4Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_50k.html (a html file whose size is 50Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_100k.html (a html file whose size is 100Kbytes) #ab2 -c 50 -n 100 https://192.168.10.5/test_200k.html (a html file whose size is 200Kbytes) Here is the result: Algorithm engine 1K 4K 50K 100K 200K AES-256-CBC+SHA1 no 14.12 13.21 7.92 4.48 2.17 (Requests per second) AES-256-CBC+SHA1 yes 51.10 23.34 7.30 3.12 1.91 (Requests per second) the data says everything. while using engine with stunnel, we got some performance increasement for processing small files, but processing bigger files is even slower than software implementation (it's quite strange, because proccessing large data blocks with hardware engine is assumed to be much faster than proccessing small data blocks). I did the same test for several times, but the result is the same. something I can be sure: 1) while doing stunnel engine test, all of the algorithms are processed by the engine. I can see it by debugging information printed on console screen. 2) the client running ab2 is a AMD64 with 1G RAM, and the web server (apache) used in the test above is an XEON with 2G RAM. so the bottleneck should be neither ab2 nor apache. So here are my questions: Has anyone tried stunnel with a hardware acceleartor? How about the performance? BTW, attached to this mail is a little patch for stunnel-4.14 which allows the engine directive in stunnel.conf to be set to either a engine id or a shared object path refer to the engine (ie. engine = /root/libcavium.so) Best regards, Zhuang Yuyao --- stunnel-4.14/src/ssl.c Thu Oct 27 09:42:54 2005 UTC +++ stunnel/src/ssl.c Tue Mar 28 08:48:03 2006 UTC @@ -122,6 +143,21 @@ } #if (SSLEAY_VERSION_NUMBER >= 0x00907000L) && defined(HAVE_OSSL_ENGINE_H) +static ENGINE *load_dynamic_engine(const char *engine) +{ + ENGINE *e = ENGINE_by_id("dynamic"); + if (e) + { + if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0) + || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) + { + ENGINE_free(e); + e = NULL; + } + } + return e; +} + static void init_engine(void) { ENGINE *e; @@ -133,9 +169,12 @@ } e=ENGINE_by_id(options.engine); if(!e) { + e = load_dynamic_engine(options.engine); + if (!e) { s_log(LOG_ERR, "Engine not found"); exit(1); } + } if(!ENGINE_init(e)) { s_log(LOG_ERR, "Engine can't be initialized"); ENGINE_free(e);

2 1

autostart stunnel at boot
by christof mestdag 03 Apr '06

03 Apr '06

hi is there another solution for booting stunnel without writting a custom rc5 script ? DO i have to make changes to make it works as a daemon? -> stunnel.conf client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636

1 0

Re: [stunnel-users] Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 02 Apr '06

02 Apr '06

Hi everybody, I found my mistake !! The process is not good. This is the correct process : browser (localhost:8118) <-> (localhost:8118) privoxy <-web-> server [and] (localhost:8888) stunnel (server:443) So with only privoxy like proxy in my Firefox config - when I ask http://server/page.html , data is modified by privoxy - when I ask https://server/page.html, data is transmitted by privoxy - when I ask http://localhost:888/page.html data is modified by privoxy and the real data transmitted is https://server/page.html , stunnel managing SSL between localhost and server. My new config : [https] accept = 8888 connect = server:443 In fact, it was the stunnel main function that I didn't understand. Sorry :) Thanks to exos, and hope it will help someone, Xavier Xavier Cheney <xav26000(a)yahoo.fr> a écrit : Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier

1 0

Config for client proxy https (privoxy + stunnel)
by Xavier Cheney 31 Mar '06

31 Mar '06

Hi, I wan to customize web page before viewing by my browser Firefox. With "privoxy" (www.privoxy.org) I can modify (proxy filter) HTTP web page, but not HTTPS pages. So, I want to use stunnel, to transfer HTTPS in HTTP between my proxy and server, like this : browser (8118) <-> (8118) privoxy (8888) <-> (8888) stunnel (server:443) <-web-> server This is my stunnel.conf : ---------------------------------------------------- ciphers = RC4-MD5:DES-CBC3-SHA verify = 0 debug = 7 client = yes [https] accept = 8888 connect = server.server.com:443 TIMEOUTclose = 0 ---------------------------------------------------- And my log : ---------------------------------------------------- 2006.03.31 11:40:02 LOG7[3396:2944]: RAND_status claims sufficient entropy for the PRNG 2006.03.31 11:40:02 LOG6[3396:2944]: PRNG seeded successfully 2006.03.31 11:40:02 LOG7[3396:2944]: SSL context initialized for service https 2006.03.31 11:40:02 LOG5[3396:2944]: stunnel 4.15 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.03.31 11:40:02 LOG5[3396:2944]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.03.31 11:40:02 LOG5[3396:2952]: No limit detected for the number of clients 2006.03.31 11:40:02 LOG7[3396:2952]: FD 192 in non-blocking mode 2006.03.31 11:40:02 LOG7[3396:2952]: SO_REUSEADDR option set on accept socket 2006.03.31 11:40:02 LOG7[3396:2952]: https bound to 0.0.0.0:8888 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=200 from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3320]: https started 2006.03.31 11:40:07 LOG7[3396:3320]: FD 200 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3320]: https connected from 127.0.0.1:2414 2006.03.31 11:40:07 LOG7[3396:3320]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3320]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: waiting 10 seconds 2006.03.31 11:40:07 LOG7[3396:3320]: connect_wait: connected 2006.03.31 11:40:07 LOG7[3396:3320]: Remote FD=232 initialized 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): before/connect initialization 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server certificate A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read server done A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write client key exchange A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:07 LOG7[3396:3320]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:07 LOG7[3396:3320]: 1 items in the session cache 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects (SSL_connect()) 2006.03.31 11:40:07 LOG7[3396:3320]: 1 client connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 client renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects (SSL_accept()) 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server connects that finished 2006.03.31 11:40:07 LOG7[3396:3320]: 0 server renegotiations requested 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache hits 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache misses 2006.03.31 11:40:07 LOG7[3396:3320]: 0 session cache timeouts 2006.03.31 11:40:07 LOG6[3396:3320]: SSL connected: new session negotiated 2006.03.31 11:40:07 LOG6[3396:3320]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2006.03.31 11:40:07 LOG7[3396:3320]: Socket closed on read 2006.03.31 11:40:07 LOG7[3396:3320]: SSL write shutdown 2006.03.31 11:40:07 LOG7[3396:3320]: SSL alert (write): warning: close notify 2006.03.31 11:40:07 LOG7[3396:3320]: SSL_shutdown retrying 2006.03.31 11:40:07 LOG7[3396:3320]: SSL doesn't need to read or write 2006.03.31 11:40:07 LOG6[3396:3320]: s_poll_wait timeout: connection close 2006.03.31 11:40:07 LOG5[3396:3320]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:07 LOG7[3396:3320]: https finished (0 left) 2006.03.31 11:40:07 LOG7[3396:2952]: https accepted FD=220 from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:2952]: Creating a new thread 2006.03.31 11:40:07 LOG7[3396:2952]: New thread created 2006.03.31 11:40:07 LOG7[3396:3944]: https started 2006.03.31 11:40:07 LOG7[3396:3944]: FD 220 in non-blocking mode 2006.03.31 11:40:07 LOG5[3396:3944]: https connected from 127.0.0.1:2417 2006.03.31 11:40:07 LOG7[3396:3944]: FD 232 in non-blocking mode 2006.03.31 11:40:07 LOG7[3396:3944]: https connecting 195.101.206.82:443 2006.03.31 11:40:07 LOG7[3396:3944]: connect_wait: waiting 10 seconds 2006.03.31 11:40:08 LOG7[3396:3944]: connect_wait: connected 2006.03.31 11:40:08 LOG7[3396:3944]: Remote FD=232 initialized 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): before/connect initialization 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write client hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read server hello A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 read finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write change cipher spec A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 write finished A 2006.03.31 11:40:08 LOG7[3396:3944]: SSL state (connect): SSLv3 flush data 2006.03.31 11:40:08 LOG7[3396:3944]: 1 items in the session cache 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects (SSL_connect()) 2006.03.31 11:40:08 LOG7[3396:3944]: 2 client connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 client renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects (SSL_accept()) 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server connects that finished 2006.03.31 11:40:08 LOG7[3396:3944]: 0 server renegotiations requested 2006.03.31 11:40:08 LOG7[3396:3944]: 1 session cache hits 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache misses 2006.03.31 11:40:08 LOG7[3396:3944]: 0 session cache timeouts 2006.03.31 11:40:08 LOG6[3396:3944]: SSL connected: previous session reused 2006.03.31 11:40:08 LOG7[3396:3944]: Socket closed on read 2006.03.31 11:40:08 LOG7[3396:3944]: SSL write shutdown 2006.03.31 11:40:08 LOG7[3396:3944]: SSL alert (write): warning: close notify 2006.03.31 11:40:08 LOG7[3396:3944]: SSL_shutdown retrying 2006.03.31 11:40:08 LOG7[3396:3944]: SSL doesn't need to read or write 2006.03.31 11:40:08 LOG6[3396:3944]: s_poll_wait timeout: connection close 2006.03.31 11:40:08 LOG5[3396:3944]: Connection closed: 211 bytes sent to SSL, 163 bytes sent to socket 2006.03.31 11:40:08 LOG7[3396:3944]: https finished (0 left) ---------------------------------------------------- Note the first "Socket closed on read". I think the problem is there. The web reply is "Bad Request (Invalid URL)" Where did I do a mistake ? Thanks for answer, Xavier --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta. --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

1 0

Stunnel client failed to connect to a server?
by Xia David You -X (xiyou - Varite Inc.＠Cisco) 31 Mar '06

31 Mar '06

Hi, I have a client which is build on stunnel which is failed to talk to a secured server while we can connect to the server with IE as client. We have both Server certificate and Client Certificate. From looking the log, it appears that the IE also got the same failure in the first step, but it did not give up and tried again with "2 1 0.0470 (0.0470) C>S SSLv2 compatible client hello" and successed. so what did we do wrong here? some extra openssl library need to be built in? thanks David Both Sever side SSL dump attached (IE client and Stunnel client).

1 0

unpublished Ceritificate
by Happy Manocha 28 Mar '06

28 Mar '06

Hi all, I am a newbie with Stunnel. Can anyone let me know how can I configure my client for a server , which does not have published certificate. Though I am able to connect but it gives a warning message "The server you are connected to is using a security certificate that could not be verifed...etc". Is there any way to avoid it? An early response will be appreciated. Regds Happy Manocha

2 1

stunnel runs in background but fails to do his job
by christof mestdag 19 Mar '06

19 Mar '06

hi, i'm having difficulties using the stunnel program. I've got some help to change the syntax from 3.X to 4.X but it doesn't work. I've got this config file -> client=yes output=/var/log/stunnel.log [ldaps] accept=localhost:389 connect=192.168.1.101:636 I run it with /usr/sbin/stunnel ./stunnel.conf -> check background: ps -ef | grep stunnel root 3270 ..... /usr/sbin/stunnel ./stunnel.conf Problem is when i close on server gate 389 i can't get any input. I expect the traffic going towards port 636 on server but it doenst. I can close port 636 and open just 389. He keeps sending everyting towards 389. I also tried to create a stunnel.conf by using make stunnel.conf in the tools directory ( in you tar.gz ) but nothing changes. /var/log/stunnel.log says -> date : stunnel 4.05 on i386-red hat .... with openssl 0.9.7a ->date : FD_SETSIZE=1024 file ulimt=1024 -> 500 clients allowed any input for my problem. It's kinda important. I'm really fed up with the tutorials which shows it works and everything always fails at my place :( greetz christof

1 0

converting old syntax to 4.x syntax
by christof mestdag 17 Mar '06

17 Mar '06

Hi, i've got a old syntax and i don't find what the new syntax might be. stunnel -c -d localhost:389 -r win2003server:636 ( I want to make a tunnel to the ssl port of the active directory server to allow password changes ) i've read a possibility which allows no use of certificates but it was in old syntax. any input to change that syntax? i thought it might be something like this. -> client=yes foreground=no accept = 389 connect = win2003server.FME.local what do i do with this. an upgrade manual speaks of an stunnel.conf file. But this one doesn't excists on my Red Hat Desktop computer. It says also that we have an /usr/local/etc/stunnel dir but i don't have that also. I only have an /etc/stunnel dir (which is totally empty ) and the /usr/sbin/stunnel tool ( version 4.05 ) thx in advance

2 2

Multiple Host Certificates
by Sligar, Benjamin 17 Mar '06

17 Mar '06

Is it possible to run one instance of stunnel and have it verify certain ports against different certificates? For instance: [listen1 5003] accept = 5003 connect = 10.61.0.132:7300 [listen2 5008] accept = 5008 connect = 10.61.0.132:7300 Would it be possible to have listen2 validate on a seperate certificate, or, will I need to run a second instance of stunnel on my box and have it point to the different certificate? Basically, I want to know if I can setup a different certificate on a per-port basis. I don't see any options in the definition of the listen port that I can specify a different CERT, only the default CERT option at the top of the config file. Version: stunnel-4.04 Options cert = /usr/local/conf/ssl.pem chroot = /usr/local/stunnel-4.04/var/run/stunnel/ pid = /stunnel.pid setuid = www setgid = webgroup options = NO_SSLv2 ciphers = DES-CBC3-SHA:IDEA-CBC-SHA:RC4-SHA:RC4-MD5:AES256-SHA:AES128-SHA uname -a Linux ssl 2.4.7-10 #1 Thu Sep 6 17:27:27 EDT 2001 i686 unknown gcc -v Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/2.96/specs gcc version 2.96 20000731 (Red Hat Linux 7.1 2.96-98) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 This e-mail message is for the sole use of the intended recipient(s) and may contain confidential and privileged information of Transaction Network Services. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

Help with config of stunnel.
by mike smith 16 Mar '06

16 Mar '06

I am trying to set up a tunnel for telnet. I am doing this just to learn how to get stunnel to work. I thought this would be easy way to learn how to use stunnel for other uses we have. My problem is I don't understand how to start it on the client side. I can telnet to the server without stunnel but I don't know how to start stunnel on the client side. The log file shows ssltelnet bound to 0.0.0.0:23 for the client and ssltelnet bound to 0.0.0.0:992 for the server If you have any ideas what I may need to do I would be greatfull. I'm sure that I'm missing a step configuring it. This is what my stunnel.conf files look like for the server cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = no debug = 7 output = /stunnel.log [ssltelnet] accept = 992 connect = 23 For the Client cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/run/stunnel/ pid = /stunnel.pid setuid = nobody setgid = nobody client = yes debug = 7 output = /stunnel.log [ssltelnet] accept = 23 connect = 192.168.1.102:992 --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations! --------------------------------- Yahoo! Travel Find great deals to the top 10 hottest destinations!

1 0

IE tries to verify client certificate?
by Don Werve 15 Mar '06

15 Mar '06

I've got stunnel providing SSL wrapper services for an otherwise SSL-stupid vendor-webserver-thingy that listens on port 80. I'm using a wildcard certificate purchased from $VENDOR, and it seems to work fine in Safari, Firefox, w3m, and basically everything SSL aware known to Man. Except, that is, Internet Explorer, where the user gets a popup window asking them to choose a certificate to verify their connection. This is really throwing me for a loop; I've tried setting 'verify = 0' and 'options = ALL' in the service definition under stunnel, no dice. Any ideas why IE thinks it needs to verify, but nothing else does? -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

1 0

GeoTrust QuickSSL cert and stunnel
by Steve Shepherd 15 Mar '06

15 Mar '06

I've got a client that has a GeoTrust "QuickSSL" certificate (we normally deal with Thawte). I installed the cert/key, but it is not functioning (pulling up default certificate), so I figured I would need the CA. I gathered the CA, so in the file I have: Certificate Private Key Certificate GeoTrust CA Where is the default location to install other CA's and/or chained certs? Thanks!

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

That would be my guess but the last time I wanted static binaries was Redhat 2.1 on a DEC Alpha-based machine, sorry. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Hal Vaughan Sent: Wednesday, March 15, 2006 1:25 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 13:04, Kevin A. McGrail wrote: > Do you have static libraries in your SSL lib or just shared libraries? > i.e. libssl.a (static) and libssl.so (dynamic) or just one or the > other? > > Have you tested with ldd? > > For example, on my machine, I get this showing me I'm linking > dynamically. > > ldd /usr/sbin/stunnel > libutil.so.1 => /lib/libutil.so.1 (0x40023000) > libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) > libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) > libdl.so.2 => /lib/libdl.so.2 (0x40050000) > libssl.so.2 => /lib/libssl.so.2 (0x40053000) > libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) > libc.so.6 => /lib/i686/libc.so.6 (0x42000000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > Regards, > KAM Yes, I'm getting the same thing, so it's linking to the shared libraries, even though in the cases I've checked, I have the static libraries. Hal _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

Do you have static libraries in your SSL lib or just shared libraries? i.e. libssl.a (static) and libssl.so (dynamic) or just one or the other? Have you tested with ldd? For example, on my machine, I get this showing me I'm linking dynamically. ldd /usr/sbin/stunnel libutil.so.1 => /lib/libutil.so.1 (0x40023000) libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) libdl.so.2 => /lib/libdl.so.2 (0x40050000) libssl.so.2 => /lib/libssl.so.2 (0x40053000) libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) libc.so.6 => /lib/i686/libc.so.6 (0x42000000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Regards, KAM -----Original Message----- From: Hal Vaughan [mailto:[email protected]] Sent: Wednesday, March 15, 2006 12:55 PM To: Kevin A. McGrail Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 12:24, you wrote: > It's not going to use source. It's going to use headers and compiled > libraries. Specifying it just helps point it to the correct headers > and libraries if you for example, have them installed in an unusual > place or have more than one set on your machine. Does it link to those libs or incorporate them into the binary (if I'm building static with the correct command line options)? Sorry to ask so many questions, but I've had no experience in C or C++. Thanks, Hal

2 1

Static Version Built?
by Hal Vaughan 15 Mar '06

15 Mar '06

Okay, I think I have a static version of Stunnel now. Thanks to help and answers from Jan and Keven! I did this: ./configure --with-ssl=/usr --enable-static --disable-shared --disable-libwrap I'm not sure about the "--with-ssl" option, but it didn't seem to want to work without it. So I have a few questions: 1) How can I be sure it is static? 2) If it isn't static and I run it on a system that does not have all it needs, will it give me errors immediately, or only if a subroutine needs a library that isn't there. 3) Does the "--disable-libwrap" or anything else remove any features? 4) Does using the "--with-ssl" option make it use the libs on my system and make it non-static? 5) My "best guess" is that to install a static version, I just copy over the files src/stunnel and src/libstunnel.la to /usr/bin and /usr/lib, respectively. Is that right? (And, of course, copy man files to the right place.) Thanks -- I hope I'll be done with all these questions soon. Hal

2 4

Logging change in 4.15
by MeeAGhost 15 Mar '06

15 Mar '06

Running 4.15 the messages below being written to STDOUT whenever I start stunnel but not written to the the file defined by output in the .conf file. In prior versions the messages were written to whatever I had defined output to equal. 2006.03.14 19:40:03 LOG7[11513:1]: Snagged 64 random bytes from /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: Wrote 1024 new random bytes to /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.14 19:40:03 LOG6[11513:1]: PRNG seeded successfully 2006.03.14 19:40:03 LOG7[11513:1]: Certificate: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Key file: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Loaded verify certificates from /usr/local/etc/stunnel/cacert.pem 2006.03.14 19:40:03 LOG7[11513:1]: Verify directory set to /usr/local/etc/stunnel/certificates 2006.03.14 19:40:03 LOG5[11513:1]: Peer certificate location /usr/local/etc/stunnel/certificates I looked in ctx.c and ssl.c at the calls to s_log (in log.c) but wasn't able to determine what would cause some messages to be written to the output file and the messages above to be written to STDOUT. I think it has to do with file_putline not being passed the output file name. Anyone else seeing this behavior? -- Chris

2 1

What is "lwrap"? (compiling problem)
by Hal Vaughan 15 Mar '06

15 Mar '06

I keep getting a message: /usr/bin/ld: cannot find -lwrap when I try make. I had to use: ./configure --with-ssl=/usr and it worked, but I keep getting the above error message. I've Googled for it and it seems to reference an SSL library, but it looks like I've got them all installed (unless it needs Python SSL libraries). Thanks! Hal

1 0

SSL Libraries on Debian
by Hal Vaughan 14 Mar '06

14 Mar '06

I tried compiling Stunnel on Debian and get an error -- I need the ssl libraries. I tried ./configure --with-ssl=/usr/lib/ssl, which is where libssl-dev was installed, and it doesn't help. There is a libssl file in /usr/lib, but --with-ssl=/usr/lib/ssl doesn't seem to work either. What package on Debian provides the needed headers (according to aptitude, libssl-dev, the one I installed, does, but experience is telling me otherwise). (This, btw, is why I am trying to make static binaries -- you can never tell what to expect on Linux systems at this point. Often config/make doesn't work and there are many times when packages don't work out for one reason or another.) Thanks for any help on this. Hal

3 4

stunnel 4.14 died silently under traffic stress test
by Zhuang Yuyao 14 Mar '06

14 Mar '06

Hi, While doing apache benchmark test, stunnel 4.14 died silently. Network topo: client(192.168.20.81 debian running ab2) ---(https)---> gateway(192.168.20.1 running stunnel in server mode) ---(http)---> web server(192.168.10.254) Gateway hardware: 80386 compatible cpu (VIA C3 400Mhz); RAM: 64M stunnel.conf: ############################### ..... compression = zlib client = no ciphers = DES-CBC3-SHA:DES-CBC3-MD5 verify = 1 [test] accept = 443 connect = 192.168.10.254:80 TIMEOUTclose = 0 ############################### Web Server hardware: Dell 2850 with 2G RAM. test_100k.html is a html file whose size is 100k bytes. test_4k.html is a html file whose size is 4k bytes. In client, I am using ab2 as the stress test tool: #ab2 -n 200 -c 100 https://192.168.20.1:443/test_4k.html (means 200 request and 100 concurrency) successfully finished. #ab2 -n 200 -c 100 https://192.168.20.1:443/test_100k.html (means 200 request and 100 concurrency) stunnel died after a few seconds, running log shows: 2006.03.09 15:20:39 LOG5[6962:1024]: stunnel 4.14 on i386-pc-linux-gnu PTHREAD+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.03.09 15:20:39 LOG5[6962:1024]: 500 clients allowed 2006.03.09 15:20:53 LOG5[6964:1026]: test connected from 192.168.20.81:50186 2006.03.09 15:20:53 LOG5[6965:2051]: test connected from 192.168.20.81:50187 2006.03.09 15:20:53 LOG5[6966:3076]: test connected from 192.168.20.81:50188 2006.03.09 15:20:53 LOG5[6967:4101]: test connected from 192.168.20.81:50189 2006.03.09 15:20:53 LOG5[6968:5126]: test connected from 192.168.20.81:50190 2006.03.09 15:20:54 LOG5[6969:6151]: test connected from 192.168.20.81:50191 2006.03.09 15:20:54 LOG5[6970:7176]: test connected from 192.168.20.81:50192 2006.03.09 15:20:54 LOG5[6971:8201]: test connected from 192.168.20.81:50193 2006.03.09 15:20:54 LOG5[6972:9226]: test connected from 192.168.20.81:50194 2006.03.09 15:20:54 LOG5[6973:10251]: test connected from 192.168.20.81:50195 2006.03.09 15:20:54 LOG5[6974:11276]: test connected from 192.168.20.81:50196 2006.03.09 15:20:54 LOG5[6975:12301]: test connected from 192.168.20.81:50197 2006.03.09 15:20:54 LOG5[6976:13326]: test connected from 192.168.20.81:50198 2006.03.09 15:20:54 LOG5[6977:14351]: test connected from 192.168.20.81:50199 2006.03.09 15:20:54 LOG5[6978:15376]: test connected from 192.168.20.81:50200 2006.03.09 15:20:54 LOG5[6979:16401]: test connected from 192.168.20.81:50201 2006.03.09 15:20:54 LOG5[6980:17426]: test connected from 192.168.20.81:50202 2006.03.09 15:20:54 LOG5[6981:18451]: test connected from 192.168.20.81:50203 2006.03.09 15:20:54 LOG5[6982:19476]: test connected from 192.168.20.81:50204 2006.03.09 15:20:54 LOG5[6983:20501]: test connected from 192.168.20.81:50205 2006.03.09 15:20:54 LOG5[6984:21526]: test connected from 192.168.20.81:50206 2006.03.09 15:20:54 LOG5[6985:22551]: test connected from 192.168.20.81:50207 2006.03.09 15:20:54 LOG5[6986:23576]: test connected from 192.168.20.81:50208 2006.03.09 15:20:54 LOG5[6987:24601]: test connected from 192.168.20.81:50209 2006.03.09 15:20:54 LOG5[6988:25626]: test connected from 192.168.20.81:50210 2006.03.09 15:20:54 LOG5[6989:26651]: test connected from 192.168.20.81:50211 2006.03.09 15:20:54 LOG5[6990:27676]: test connected from 192.168.20.81:50212 2006.03.09 15:20:54 LOG5[6991:28701]: test connected from 192.168.20.81:50213 2006.03.09 15:20:54 LOG5[6992:29726]: test connected from 192.168.20.81:50214 2006.03.09 15:20:54 LOG5[6993:30751]: test connected from 192.168.20.81:50215 2006.03.09 15:20:54 LOG5[6994:31776]: test connected from 192.168.20.81:50216 2006.03.09 15:20:54 LOG5[6995:32801]: test connected from 192.168.20.81:50217 2006.03.09 15:20:54 LOG5[6996:33826]: test connected from 192.168.20.81:50218 2006.03.09 15:20:54 LOG5[6997:34851]: test connected from 192.168.20.81:50219 2006.03.09 15:20:54 LOG5[6998:35876]: test connected from 192.168.20.81:50220 2006.03.09 15:20:54 LOG5[6999:36901]: test connected from 192.168.20.81:50221 2006.03.09 15:20:54 LOG5[7000:37926]: test connected from 192.168.20.81:50222 2006.03.09 15:20:54 LOG5[7001:38951]: test connected from 192.168.20.81:50223 2006.03.09 15:20:54 LOG5[7002:39976]: test connected from 192.168.20.81:50224 2006.03.09 15:20:54 LOG5[7003:41001]: test connected from 192.168.20.81:50225 2006.03.09 15:20:54 LOG5[7004:42026]: test connected from 192.168.20.81:50226 2006.03.09 15:20:55 LOG5[7005:43051]: test connected from 192.168.20.81:50227 2006.03.09 15:20:55 LOG5[7006:44076]: test connected from 192.168.20.81:50228 2006.03.09 15:20:55 LOG5[7007:45101]: test connected from 192.168.20.81:50229 2006.03.09 15:20:55 LOG5[7008:46126]: test connected from 192.168.20.81:50230 2006.03.09 15:20:55 LOG5[7009:47151]: test connected from 192.168.20.81:50231 2006.03.09 15:20:55 LOG5[7010:48176]: test connected from 192.168.20.81:50232 2006.03.09 15:20:55 LOG5[7011:49201]: test connected from 192.168.20.81:50233 2006.03.09 15:20:55 LOG5[7012:50226]: test connected from 192.168.20.81:50234 2006.03.09 15:20:55 LOG5[7013:51251]: test connected from 192.168.20.81:50235 2006.03.09 15:20:55 LOG5[7014:52276]: test connected from 192.168.20.81:50236 2006.03.09 15:20:55 LOG5[7015:53301]: test connected from 192.168.20.81:50237 2006.03.09 15:20:55 LOG5[7016:54326]: test connected from 192.168.20.81:50238 2006.03.09 15:20:55 LOG5[7017:55351]: test connected from 192.168.20.81:50239 2006.03.09 15:20:55 LOG5[7018:56376]: test connected from 192.168.20.81:50240 2006.03.09 15:20:55 LOG5[7019:57401]: test connected from 192.168.20.81:50241 2006.03.09 15:20:55 LOG5[7020:58426]: test connected from 192.168.20.81:50242 2006.03.09 15:20:55 LOG5[7021:59451]: test connected from 192.168.20.81:50243 2006.03.09 15:20:55 LOG5[7022:60476]: test connected from 192.168.20.81:50244 2006.03.09 15:20:55 LOG5[7023:61501]: test connected from 192.168.20.81:50245 2006.03.09 15:20:55 LOG5[7024:62526]: test connected from 192.168.20.81:50246 Killed It looks like that is resource on gateway is exhausted under such a traffic, but my question is: why stunnel just died instead of rejecting further connections. Thanks very much. Zhuang Yuyao

2 7

Static Binaries for Linux? (Didn't get answer previously)
by Hal Vaughan 13 Mar '06

13 Mar '06

I've brought this up before and didn't get ANY answer at all, and I'm sure someone involved with Stunnel would at least know if what I'm asking is possible. I know help is given on a volunteer basis, so if someone could help me figure this out, it would be a huge help. So far I've spent over a week on getting Stunnel or another program to do the job and if I can't get this to work, I need to just drop Stunnel and figure out how to do the same thing in Java. So thanks for any help. I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Is there a way to get static binaries for Linux? I don't know C or C++ or much more than running ./configure && make && make install. I'd like to know if it is possible or what is needed to create static binaries of the files so I could easily install stunnel on any Linux system by just copying over the proper files. Also, what archive format does the Windows installer use? I'd like to do something similar for Windows, so if I could pull the files out of the installer and copy them over myself, it would be a huge help. Thanks! Hal

3 4

Compile failure with 4.15
by MeeAGhost 13 Mar '06

13 Mar '06

I ran ./configure --enable-dh --disable-libwrap then when I try to execute make the build fails: [...] if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.15\" -DPACKAGE_STRING=\"stunnel\ 4.15\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.15\" -DHOST=\"sparc-sun-solaris2.9\" -DCPU_SPARC=1 -DVENDOR_SUN=1 -DOS_SOLARIS2_9=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DHAVE_LIBNSL=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE___MAKECONTEXT_V2=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local\" -DHAVE_OSSL_ENGINE_H=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DUSE_DH=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi ctx.c: In function `init_dh': ctx.c:170: error: `section' undeclared (first use in this function) ctx.c:170: error: (Each undeclared identifier is reported only once ctx.c:170: error: for each function it appears in.) ctx.c:198: error: `ctx' undeclared (first use in this function) ctx.c: In function `crl_callback': ctx.c:491: warning: cast increases required alignment of target type make[1]: *** [ctx.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.15/src' make: *** [all-recursive] Error 1 I checked ctx.c and couldn't see where section and ctx are being defined inside of the init_dh function nor could I see them defined in the header files. Am I missing something? TIA for any assistance. -- Chris

2 1

Rainbow Technologies CryptoSwift CS200 driver
by Michal Trojnara 11 Mar '06

11 Mar '06

Dear Users, I just bought a second-hand Rainbow Technologies CryptoSwift CS200 card to test engine support for stunnel. Unfortunately I can't find any Linux/Windows driver for this card. Do you have one? Please help. Best regards, Mike

2 1

stunnel 4.15 released
by Michal Trojnara 11 Mar '06

11 Mar '06

Version 4.15, 2006.03.11, urgency: LOW: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * Bugfixes - Fix for pthreads on Solaris 10 (thx to Hans Werner Strube <strube(a)physik3.gwdg.de>). - Attempt to autodetect socklen_t type in configure script. - Default threading model changed to pthread for better portability. - DH parameters are not included in the certificate by default. * New features sponsored by Software House http://www.swhouse.com/ - Most SSL-related options (including client, cert, key) are now available on service level, so it is possible to have an SSL client and an SSL server in a single stunnel process. - Windows CE (version 3.0 and higher) support. * New features - Client mode CONNECT protocol support (RFC 2817 section 5.2). http://www.ietf.org/rfc/rfc2817.txt - Retrying exec+connect services added. * File locations are more compliant to Filesystem Hierarchy Standard 2.3 - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup sha1sum for stunnel-4.15.tar.gz: 735406c1ca94904581158a434214e1f6568539d0 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

"STACK_RESERVE is too high" after every connect
by Rob Munsch 10 Mar '06

10 Mar '06

Hello. I've recently gone on a self-inflicted crash course on openssl and seem to have gotten a centralized logging system going, logging to MySQL. I'm seeing everything i'd expect to see, but with an extra bit: what is STACK_RESERVE, and why is it too high? Some context, mildly sanitized: |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: syslog-ng connected from x.x.x.x:44032| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=1, /C=US/ST=Pennsylvania/L=Philadelphia/O=Solutions for Progress/CN=blah.com/emailAddress=blah@blah| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=0, /C=US/ST=Pennsylvania/O=Solutions for Progress/OU=IT/CN=IT/emailAddress=blah@blah| |Mar 9 20:39:02 isis stunnel: LOG5[24810:6]: Connection closed: 0 bytes sent to SSL, 2891 bytes sent to socket| |Mar 9 20:39:02 isis stunnel: LOG3[24810:6]: STACK_RESERVE is too high| this is daemon.log on the server machine (isis). Messages from the remote host are going to MySQL successfully. But at the end of every apparently-successful transaction, there's this stack complaint. Can't find anything in the archives or via Google for "stunnel stack_reserve," which i found really odd, which is why i'm here... Version output: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 Thanks! -- Rob Munsch Solutions For Progress IT

2 1

RE: How to get tcpwrappers configured/compiled into stunnel 4.04 on Tru64 UNIX 5.1B
by John Lanier 08 Mar '06

08 Mar '06

Hello, I am a newbie to stunnel and tcpwrappers, so please bear with me: I am trying to compile tcpwrapper support into stunnel v4.04 on Tru64 UNIX v5.1B (apparently v4.14 does not compile on 5.1A or higher, per http://stunnel.mirt.net/pipermail/stunnel-users/2006-January/000935.html). I am having what appears to be problems getting tcpwrapper support to compile with 4.04. I have consulted the following resources, but I am still having problems: ------------------------------------------------------------------------------------------------------- 1. http://www.stunnel.org/faq/troubleshooting.html#ToC9 "configure isn't finding my TCP Wrapper installation" Solution: You probably have it in a non-standard place, ie somewhere that gcc can't find it on it's own. Let's say you had your tcp wrappers installed in /opt/tcpd_7.6. To help gcc find your include files and libraries, you'd want to set three environment variables as follows: CFLAGS="$CFLAGS -I/opt/tcpd_7.6/include" CPPFLAGS="$CPPFLAGS -I/opt/tcpd_7.6/include" LDFLAGS="$LDFLAGS -L/opt/tcpd_7.6/lib" export CFLAGS CPPFLAGS LDFLAGS And then re-run configure. This is the generic way to have configure find specific libraries, and is not specific to Stunnel itself. 2. http://www.stunnel.org/faq/run.html#ToC5 "Running stunnel with TCP wrappers" You do not need to use the tcpd binary to wrap stunnel (although you could). You can can compile in support for TCP wrappers when you compile stunnel itself. The configure program should be able to determine if the libwrap library (-lwrap) and headers are available in standard locations. ............. I have openssl 0.9.7h installed on ccpe01 v51b pk#5, with tcp-wrappers7.6. I did the configure, make and make install and things. All stages appeared successful, but then I attempted the ./configure --with-tcp-wrappers and it errored with -lwrap not found. checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... no checking for socket in -lsocket... no checking for pthread_create in -lpthread... no checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... not found <-- .............. So then I tried assigning the 3 environment variables and things got worse. The include and lib directories are referenced for tcpd 7.6, but after installing tcp wrappers I do not find include or lib directories for tcpd. Q: Should I expect NOT to see the include or lib directories as defined in #1 above, and, if so, will specifying the absolute path to the tcpwrapper images (EX: /var/tcp_wrappers/tcp_wrappers_7.6) suffice? 3. I followed these instructions when compiling/configuring tcpd v7.6 (downloaded from ftp://ftp.porcupine.org/pub/security/index.html): ............ 7.1 - Easy configuration and installation ----------------------------------------- The "easy" recipe requires no changes to existing software or configuration files. Basically, you move the daemons that you want to protect to a different directory and plug the resulting holes with copies of the wrapper programs. If you don't run Ultrix, you won't need the miscd wrapper program. The miscd daemon implements among others the SYSTAT service, which produces the same output as the WHO command. Type `make' and follow the instructions. The Makefile comes with ready-to-use templates for many common UNIX implementations (sun, ultrix, hp-ux, aix, irix,...). .............. Thanks in advance for any guidance and/or advice that you can offer. --John Lanier

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users