- stunnel-users - stunnel.org

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

That would be my guess but the last time I wanted static binaries was Redhat 2.1 on a DEC Alpha-based machine, sorry. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Hal Vaughan Sent: Wednesday, March 15, 2006 1:25 PM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 13:04, Kevin A. McGrail wrote: > Do you have static libraries in your SSL lib or just shared libraries? > i.e. libssl.a (static) and libssl.so (dynamic) or just one or the > other? > > Have you tested with ldd? > > For example, on my machine, I get this showing me I'm linking > dynamically. > > ldd /usr/sbin/stunnel > libutil.so.1 => /lib/libutil.so.1 (0x40023000) > libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) > libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) > libdl.so.2 => /lib/libdl.so.2 (0x40050000) > libssl.so.2 => /lib/libssl.so.2 (0x40053000) > libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) > libc.so.6 => /lib/i686/libc.so.6 (0x42000000) > /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) > > Regards, > KAM Yes, I'm getting the same thing, so it's linking to the shared libraries, even though in the cases I've checked, I have the static libraries. Hal _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

RE: [stunnel-users] Static Version Built?
by Kevin A. McGrail 15 Mar '06

15 Mar '06

Do you have static libraries in your SSL lib or just shared libraries? i.e. libssl.a (static) and libssl.so (dynamic) or just one or the other? Have you tested with ldd? For example, on my machine, I get this showing me I'm linking dynamically. ldd /usr/sbin/stunnel libutil.so.1 => /lib/libutil.so.1 (0x40023000) libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40027000) libnsl.so.1 => /lib/libnsl.so.1 (0x4003b000) libdl.so.2 => /lib/libdl.so.2 (0x40050000) libssl.so.2 => /lib/libssl.so.2 (0x40053000) libcrypto.so.2 => /lib/libcrypto.so.2 (0x40080000) libc.so.6 => /lib/i686/libc.so.6 (0x42000000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) Regards, KAM -----Original Message----- From: Hal Vaughan [mailto:[email protected]] Sent: Wednesday, March 15, 2006 12:55 PM To: Kevin A. McGrail Subject: Re: [stunnel-users] Static Version Built? On Wednesday 15 March 2006 12:24, you wrote: > It's not going to use source. It's going to use headers and compiled > libraries. Specifying it just helps point it to the correct headers > and libraries if you for example, have them installed in an unusual > place or have more than one set on your machine. Does it link to those libs or incorporate them into the binary (if I'm building static with the correct command line options)? Sorry to ask so many questions, but I've had no experience in C or C++. Thanks, Hal

2 1

Static Version Built?
by Hal Vaughan 15 Mar '06

15 Mar '06

Okay, I think I have a static version of Stunnel now. Thanks to help and answers from Jan and Keven! I did this: ./configure --with-ssl=/usr --enable-static --disable-shared --disable-libwrap I'm not sure about the "--with-ssl" option, but it didn't seem to want to work without it. So I have a few questions: 1) How can I be sure it is static? 2) If it isn't static and I run it on a system that does not have all it needs, will it give me errors immediately, or only if a subroutine needs a library that isn't there. 3) Does the "--disable-libwrap" or anything else remove any features? 4) Does using the "--with-ssl" option make it use the libs on my system and make it non-static? 5) My "best guess" is that to install a static version, I just copy over the files src/stunnel and src/libstunnel.la to /usr/bin and /usr/lib, respectively. Is that right? (And, of course, copy man files to the right place.) Thanks -- I hope I'll be done with all these questions soon. Hal

2 4

Logging change in 4.15
by MeeAGhost 15 Mar '06

15 Mar '06

Running 4.15 the messages below being written to STDOUT whenever I start stunnel but not written to the the file defined by output in the .conf file. In prior versions the messages were written to whatever I had defined output to equal. 2006.03.14 19:40:03 LOG7[11513:1]: Snagged 64 random bytes from /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: Wrote 1024 new random bytes to /export/home/ghost/.rnd 2006.03.14 19:40:03 LOG7[11513:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.14 19:40:03 LOG6[11513:1]: PRNG seeded successfully 2006.03.14 19:40:03 LOG7[11513:1]: Certificate: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Key file: /usr/local/etc/stunnel/server.pem 2006.03.14 19:40:03 LOG7[11513:1]: Loaded verify certificates from /usr/local/etc/stunnel/cacert.pem 2006.03.14 19:40:03 LOG7[11513:1]: Verify directory set to /usr/local/etc/stunnel/certificates 2006.03.14 19:40:03 LOG5[11513:1]: Peer certificate location /usr/local/etc/stunnel/certificates I looked in ctx.c and ssl.c at the calls to s_log (in log.c) but wasn't able to determine what would cause some messages to be written to the output file and the messages above to be written to STDOUT. I think it has to do with file_putline not being passed the output file name. Anyone else seeing this behavior? -- Chris

2 1

What is "lwrap"? (compiling problem)
by Hal Vaughan 15 Mar '06

15 Mar '06

I keep getting a message: /usr/bin/ld: cannot find -lwrap when I try make. I had to use: ./configure --with-ssl=/usr and it worked, but I keep getting the above error message. I've Googled for it and it seems to reference an SSL library, but it looks like I've got them all installed (unless it needs Python SSL libraries). Thanks! Hal

1 0

SSL Libraries on Debian
by Hal Vaughan 14 Mar '06

14 Mar '06

I tried compiling Stunnel on Debian and get an error -- I need the ssl libraries. I tried ./configure --with-ssl=/usr/lib/ssl, which is where libssl-dev was installed, and it doesn't help. There is a libssl file in /usr/lib, but --with-ssl=/usr/lib/ssl doesn't seem to work either. What package on Debian provides the needed headers (according to aptitude, libssl-dev, the one I installed, does, but experience is telling me otherwise). (This, btw, is why I am trying to make static binaries -- you can never tell what to expect on Linux systems at this point. Often config/make doesn't work and there are many times when packages don't work out for one reason or another.) Thanks for any help on this. Hal

3 4

stunnel 4.14 died silently under traffic stress test
by Zhuang Yuyao 14 Mar '06

14 Mar '06

Hi, While doing apache benchmark test, stunnel 4.14 died silently. Network topo: client(192.168.20.81 debian running ab2) ---(https)---> gateway(192.168.20.1 running stunnel in server mode) ---(http)---> web server(192.168.10.254) Gateway hardware: 80386 compatible cpu (VIA C3 400Mhz); RAM: 64M stunnel.conf: ############################### ..... compression = zlib client = no ciphers = DES-CBC3-SHA:DES-CBC3-MD5 verify = 1 [test] accept = 443 connect = 192.168.10.254:80 TIMEOUTclose = 0 ############################### Web Server hardware: Dell 2850 with 2G RAM. test_100k.html is a html file whose size is 100k bytes. test_4k.html is a html file whose size is 4k bytes. In client, I am using ab2 as the stress test tool: #ab2 -n 200 -c 100 https://192.168.20.1:443/test_4k.html (means 200 request and 100 concurrency) successfully finished. #ab2 -n 200 -c 100 https://192.168.20.1:443/test_100k.html (means 200 request and 100 concurrency) stunnel died after a few seconds, running log shows: 2006.03.09 15:20:39 LOG5[6962:1024]: stunnel 4.14 on i386-pc-linux-gnu PTHREAD+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.03.09 15:20:39 LOG5[6962:1024]: 500 clients allowed 2006.03.09 15:20:53 LOG5[6964:1026]: test connected from 192.168.20.81:50186 2006.03.09 15:20:53 LOG5[6965:2051]: test connected from 192.168.20.81:50187 2006.03.09 15:20:53 LOG5[6966:3076]: test connected from 192.168.20.81:50188 2006.03.09 15:20:53 LOG5[6967:4101]: test connected from 192.168.20.81:50189 2006.03.09 15:20:53 LOG5[6968:5126]: test connected from 192.168.20.81:50190 2006.03.09 15:20:54 LOG5[6969:6151]: test connected from 192.168.20.81:50191 2006.03.09 15:20:54 LOG5[6970:7176]: test connected from 192.168.20.81:50192 2006.03.09 15:20:54 LOG5[6971:8201]: test connected from 192.168.20.81:50193 2006.03.09 15:20:54 LOG5[6972:9226]: test connected from 192.168.20.81:50194 2006.03.09 15:20:54 LOG5[6973:10251]: test connected from 192.168.20.81:50195 2006.03.09 15:20:54 LOG5[6974:11276]: test connected from 192.168.20.81:50196 2006.03.09 15:20:54 LOG5[6975:12301]: test connected from 192.168.20.81:50197 2006.03.09 15:20:54 LOG5[6976:13326]: test connected from 192.168.20.81:50198 2006.03.09 15:20:54 LOG5[6977:14351]: test connected from 192.168.20.81:50199 2006.03.09 15:20:54 LOG5[6978:15376]: test connected from 192.168.20.81:50200 2006.03.09 15:20:54 LOG5[6979:16401]: test connected from 192.168.20.81:50201 2006.03.09 15:20:54 LOG5[6980:17426]: test connected from 192.168.20.81:50202 2006.03.09 15:20:54 LOG5[6981:18451]: test connected from 192.168.20.81:50203 2006.03.09 15:20:54 LOG5[6982:19476]: test connected from 192.168.20.81:50204 2006.03.09 15:20:54 LOG5[6983:20501]: test connected from 192.168.20.81:50205 2006.03.09 15:20:54 LOG5[6984:21526]: test connected from 192.168.20.81:50206 2006.03.09 15:20:54 LOG5[6985:22551]: test connected from 192.168.20.81:50207 2006.03.09 15:20:54 LOG5[6986:23576]: test connected from 192.168.20.81:50208 2006.03.09 15:20:54 LOG5[6987:24601]: test connected from 192.168.20.81:50209 2006.03.09 15:20:54 LOG5[6988:25626]: test connected from 192.168.20.81:50210 2006.03.09 15:20:54 LOG5[6989:26651]: test connected from 192.168.20.81:50211 2006.03.09 15:20:54 LOG5[6990:27676]: test connected from 192.168.20.81:50212 2006.03.09 15:20:54 LOG5[6991:28701]: test connected from 192.168.20.81:50213 2006.03.09 15:20:54 LOG5[6992:29726]: test connected from 192.168.20.81:50214 2006.03.09 15:20:54 LOG5[6993:30751]: test connected from 192.168.20.81:50215 2006.03.09 15:20:54 LOG5[6994:31776]: test connected from 192.168.20.81:50216 2006.03.09 15:20:54 LOG5[6995:32801]: test connected from 192.168.20.81:50217 2006.03.09 15:20:54 LOG5[6996:33826]: test connected from 192.168.20.81:50218 2006.03.09 15:20:54 LOG5[6997:34851]: test connected from 192.168.20.81:50219 2006.03.09 15:20:54 LOG5[6998:35876]: test connected from 192.168.20.81:50220 2006.03.09 15:20:54 LOG5[6999:36901]: test connected from 192.168.20.81:50221 2006.03.09 15:20:54 LOG5[7000:37926]: test connected from 192.168.20.81:50222 2006.03.09 15:20:54 LOG5[7001:38951]: test connected from 192.168.20.81:50223 2006.03.09 15:20:54 LOG5[7002:39976]: test connected from 192.168.20.81:50224 2006.03.09 15:20:54 LOG5[7003:41001]: test connected from 192.168.20.81:50225 2006.03.09 15:20:54 LOG5[7004:42026]: test connected from 192.168.20.81:50226 2006.03.09 15:20:55 LOG5[7005:43051]: test connected from 192.168.20.81:50227 2006.03.09 15:20:55 LOG5[7006:44076]: test connected from 192.168.20.81:50228 2006.03.09 15:20:55 LOG5[7007:45101]: test connected from 192.168.20.81:50229 2006.03.09 15:20:55 LOG5[7008:46126]: test connected from 192.168.20.81:50230 2006.03.09 15:20:55 LOG5[7009:47151]: test connected from 192.168.20.81:50231 2006.03.09 15:20:55 LOG5[7010:48176]: test connected from 192.168.20.81:50232 2006.03.09 15:20:55 LOG5[7011:49201]: test connected from 192.168.20.81:50233 2006.03.09 15:20:55 LOG5[7012:50226]: test connected from 192.168.20.81:50234 2006.03.09 15:20:55 LOG5[7013:51251]: test connected from 192.168.20.81:50235 2006.03.09 15:20:55 LOG5[7014:52276]: test connected from 192.168.20.81:50236 2006.03.09 15:20:55 LOG5[7015:53301]: test connected from 192.168.20.81:50237 2006.03.09 15:20:55 LOG5[7016:54326]: test connected from 192.168.20.81:50238 2006.03.09 15:20:55 LOG5[7017:55351]: test connected from 192.168.20.81:50239 2006.03.09 15:20:55 LOG5[7018:56376]: test connected from 192.168.20.81:50240 2006.03.09 15:20:55 LOG5[7019:57401]: test connected from 192.168.20.81:50241 2006.03.09 15:20:55 LOG5[7020:58426]: test connected from 192.168.20.81:50242 2006.03.09 15:20:55 LOG5[7021:59451]: test connected from 192.168.20.81:50243 2006.03.09 15:20:55 LOG5[7022:60476]: test connected from 192.168.20.81:50244 2006.03.09 15:20:55 LOG5[7023:61501]: test connected from 192.168.20.81:50245 2006.03.09 15:20:55 LOG5[7024:62526]: test connected from 192.168.20.81:50246 Killed It looks like that is resource on gateway is exhausted under such a traffic, but my question is: why stunnel just died instead of rejecting further connections. Thanks very much. Zhuang Yuyao

2 7

Static Binaries for Linux? (Didn't get answer previously)
by Hal Vaughan 13 Mar '06

13 Mar '06

I've brought this up before and didn't get ANY answer at all, and I'm sure someone involved with Stunnel would at least know if what I'm asking is possible. I know help is given on a volunteer basis, so if someone could help me figure this out, it would be a huge help. So far I've spent over a week on getting Stunnel or another program to do the job and if I can't get this to work, I need to just drop Stunnel and figure out how to do the same thing in Java. So thanks for any help. I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Is there a way to get static binaries for Linux? I don't know C or C++ or much more than running ./configure && make && make install. I'd like to know if it is possible or what is needed to create static binaries of the files so I could easily install stunnel on any Linux system by just copying over the proper files. Also, what archive format does the Windows installer use? I'd like to do something similar for Windows, so if I could pull the files out of the installer and copy them over myself, it would be a huge help. Thanks! Hal

3 4

Compile failure with 4.15
by MeeAGhost 13 Mar '06

13 Mar '06

I ran ./configure --enable-dh --disable-libwrap then when I try to execute make the build fails: [...] if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.15\" -DPACKAGE_STRING=\"stunnel\ 4.15\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.15\" -DHOST=\"sparc-sun-solaris2.9\" -DCPU_SPARC=1 -DVENDOR_SUN=1 -DOS_SOLARIS2_9=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DHAVE_LIBNSL=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE___MAKECONTEXT_V2=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local\" -DHAVE_OSSL_ENGINE_H=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DUSE_DH=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi ctx.c: In function `init_dh': ctx.c:170: error: `section' undeclared (first use in this function) ctx.c:170: error: (Each undeclared identifier is reported only once ctx.c:170: error: for each function it appears in.) ctx.c:198: error: `ctx' undeclared (first use in this function) ctx.c: In function `crl_callback': ctx.c:491: warning: cast increases required alignment of target type make[1]: *** [ctx.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.15/src' make: *** [all-recursive] Error 1 I checked ctx.c and couldn't see where section and ctx are being defined inside of the init_dh function nor could I see them defined in the header files. Am I missing something? TIA for any assistance. -- Chris

2 1

Rainbow Technologies CryptoSwift CS200 driver
by Michal Trojnara 11 Mar '06

11 Mar '06

Dear Users, I just bought a second-hand Rainbow Technologies CryptoSwift CS200 card to test engine support for stunnel. Unfortunately I can't find any Linux/Windows driver for this card. Do you have one? Please help. Best regards, Mike

2 1

stunnel 4.15 released
by Michal Trojnara 11 Mar '06

11 Mar '06

Version 4.15, 2006.03.11, urgency: LOW: * Release notes - There are a lot of new features in this version. I recommend to test it well before upgrading your mission-critical systems. * Bugfixes - Fix for pthreads on Solaris 10 (thx to Hans Werner Strube <strube(a)physik3.gwdg.de>). - Attempt to autodetect socklen_t type in configure script. - Default threading model changed to pthread for better portability. - DH parameters are not included in the certificate by default. * New features sponsored by Software House http://www.swhouse.com/ - Most SSL-related options (including client, cert, key) are now available on service level, so it is possible to have an SSL client and an SSL server in a single stunnel process. - Windows CE (version 3.0 and higher) support. * New features - Client mode CONNECT protocol support (RFC 2817 section 5.2). http://www.ietf.org/rfc/rfc2817.txt - Retrying exec+connect services added. * File locations are more compliant to Filesystem Hierarchy Standard 2.3 - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup sha1sum for stunnel-4.15.tar.gz: 735406c1ca94904581158a434214e1f6568539d0 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

"STACK_RESERVE is too high" after every connect
by Rob Munsch 10 Mar '06

10 Mar '06

Hello. I've recently gone on a self-inflicted crash course on openssl and seem to have gotten a centralized logging system going, logging to MySQL. I'm seeing everything i'd expect to see, but with an extra bit: what is STACK_RESERVE, and why is it too high? Some context, mildly sanitized: |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: syslog-ng connected from x.x.x.x:44032| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=1, /C=US/ST=Pennsylvania/L=Philadelphia/O=Solutions for Progress/CN=blah.com/emailAddress=blah@blah| |Mar 9 18:33:34 isis stunnel: LOG5[24810:6]: VERIFY OK: depth=0, /C=US/ST=Pennsylvania/O=Solutions for Progress/OU=IT/CN=IT/emailAddress=blah@blah| |Mar 9 20:39:02 isis stunnel: LOG5[24810:6]: Connection closed: 0 bytes sent to SSL, 2891 bytes sent to socket| |Mar 9 20:39:02 isis stunnel: LOG3[24810:6]: STACK_RESERVE is too high| this is daemon.log on the server machine (isis). Messages from the remote host are going to MySQL successfully. But at the end of every apparently-successful transaction, there's this stack complaint. Can't find anything in the archives or via Google for "stunnel stack_reserve," which i found really odd, which is why i'm here... Version output: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 Thanks! -- Rob Munsch Solutions For Progress IT

2 1

RE: How to get tcpwrappers configured/compiled into stunnel 4.04 on Tru64 UNIX 5.1B
by John Lanier 08 Mar '06

08 Mar '06

Hello, I am a newbie to stunnel and tcpwrappers, so please bear with me: I am trying to compile tcpwrapper support into stunnel v4.04 on Tru64 UNIX v5.1B (apparently v4.14 does not compile on 5.1A or higher, per http://stunnel.mirt.net/pipermail/stunnel-users/2006-January/000935.html) I am having what appears to be problems getting tcpwrapper support to compile with 4.04. I have consulted the following resources, but I am still having problems: ------------------------------------------------------------------------------------------------------- 1. http://www.stunnel.org/faq/troubleshooting.html#ToC9 "configure isn't finding my TCP Wrapper installation" Solution: You probably have it in a non-standard place, ie somewhere that gcc can't find it on it's own. Let's say you had your tcp wrappers installed in /opt/tcpd_7.6. To help gcc find your include files and libraries, you'd want to set three environment variables as follows: CFLAGS="$CFLAGS -I/opt/tcpd_7.6/include" CPPFLAGS="$CPPFLAGS -I/opt/tcpd_7.6/include" LDFLAGS="$LDFLAGS -L/opt/tcpd_7.6/lib" export CFLAGS CPPFLAGS LDFLAGS And then re-run configure. This is the generic way to have configure find specific libraries, and is not specific to Stunnel itself. 2. http://www.stunnel.org/faq/run.html#ToC5 "Running stunnel with TCP wrappers" You do not need to use the tcpd binary to wrap stunnel (although you could). You can can compile in support for TCP wrappers when you compile stunnel itself. The configure program should be able to determine if the libwrap library (-lwrap) and headers are available in standard locations. ............. I have openssl 0.9.7h installed on ccpe01 v51b pk#5, with tcp-wrappers7.6. I did the configure, make and make install and things. All stages appeared successful, but then I attempted the ./configure --with-tcp-wrappers and it errored with -lwrap not found. checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... no checking for socket in -lsocket... no checking for pthread_create in -lpthread... no checking for pthread_create in -lc_r... no checking for openpty in -lutil... yes checking whether to use the libwrap (TCP wrappers) library... yes checking for hosts_access in -lwrap... not found <-- .............. So then I tried assigning the 3 environment variables and things got worse. The include and lib directories are referenced for tcpd 7.6, but after installing tcp wrappers I do not find include or lib directories for tcpd. Q: Should I expect NOT to see the include or lib directories as defined in #1 above, and, if so, will specifying the absolute path to the tcpwrapper images (EX: /var/tcp_wrappers/tcp_wrappers_7.6) suffice? 3. I followed these instructions when compiling/configuring tcpd v7.6 (downloaded from ftp://ftp.porcupine.org/pub/security/index.html) ............ 7.1 - Easy configuration and installation ----------------------------------------- The "easy" recipe requires no changes to existing software or configuration files. Basically, you move the daemons that you want to protect to a different directory and plug the resulting holes with copies of the wrapper programs. If you don't run Ultrix, you won't need the miscd wrapper program. The miscd daemon implements among others the SYSTAT service, which produces the same output as the WHO command. Type `make' and follow the instructions. The Makefile comes with ready-to-use templates for many common UNIX implementations (sun, ultrix, hp-ux, aix, irix,...). .............. Thanks in advance for any guidance and/or advice that you can offer. --John Lanier

1 0

Special Installs -- Static Binaries and Required Files
by Hal Vaughan 08 Mar '06

08 Mar '06

I may need to include Stunnel with my application so my clients behind restrictive firewalls can still enable me to work on their systems with RealVNC. I'm working with clients on both Windows and Linux. Windows: I know the installer has the files included in it in an archive, but what archive format is it, or what kind or archive program on Linux can I use to read it? Is installing Stunnel on Windows just a matter of copying the files, or are there settings I have to change in the registry? Linux: Is there any way to get static binaries (yes, I know they're bigger) so I can just copy over files to install it as a program (not as a service -- I noticed Debian set it up as a service)? Thanks! Hal

1 0

Stunnel Won't Start on Linux (even with fixed /etc/default/stunnel)
by Hal Vaughan 08 Mar '06

08 Mar '06

I'm trying to start stunnel4 on Linux. I've modified the /etc/stunnel/stunnel.conf file so I can use it with RealVNC. When I run "stunnel4 /etc/stunnel/stunnel.conf" or "/etc/init.d/stunnel4 start", neither command gives me errors or any output, even with -d 7 set. After the shell returns control to me, I do "ps -ax" and have yet to see any instance of stunnel running. There is never a file in /var/run/stunnel to indicate a working daemon if I start it as one. I have edited /etc/default/stunnel4 to look like this (changed ENABLED). I've included it and my /etc/stunnel/stunnel.conf below. No matter what I do, there is never any evidence that stunnel is staring or doing anything. Even error messages would be a big help, so I'd at least know what was wrong. Any help appreciated. I'm sure it's something so obvious I don't see how I could miss it. Thanks for any help. Hal -----------------/etc/default/stunnel4------------------------ # /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0 ------------/etc/stunnel/stunnel.conf-------------------- CAfile = /etc/stunnel/CAcert.pem CApath = /etc/stunnel/ cert = server.pem client = no verify = 3 debug = 7 [vnc] accept = 443 connect = 127.0.0.1:5500

2 2

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Here is what I'm getting Insude stunnel.conf file: cert=/usr/local/etc/stunnel/stunnel.pem cafile=/usr/local/etc/stunnel/stunnel.pem output=/var/log/stunnel.log client=yes debug=7 [1440] accept=10.10.10.2:1440 connect=192.168.19.50:1078 Launched using: stunnel /etc/stunnel/stunnel.conf -p /usr/local/etc/stunnel/stunnel.pem Log file: 2006.03.07 08:30:01 LOG5[13209:0]: Received signal 15; terminating 2006.03.07 08:30:01 LOG7[13209:0]: removing pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG5[13219:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2006.03.07 08:30:20 LOG7[13219:1]: Snagged 64 random bytes from /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: Wrote 1024 new random bytes to /root/.rnd 2006.03.07 08:30:20 LOG7[13219:1]: RAND_status claims sufficient entropy for the PRNG 2006.03.07 08:30:20 LOG6[13219:1]: PRNG seeded successfully 2006.03.07 08:30:20 LOG7[13219:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG7[13219:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2006.03.07 08:30:20 LOG6[13219:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2006.03.07 08:30:20 LOG6[13219:1]: poll() used - no FD_SETSIZE limit for file descriptors 2006.03.07 08:30:20 LOG5[13219:1]: 500 clients allowed 2006.03.07 08:30:20 LOG7[13219:1]: FD 4 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 5 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: FD 6 in non-blocking mode 2006.03.07 08:30:20 LOG7[13219:1]: SO_REUSEADDR option set on accept socket 2006.03.07 08:30:20 LOG7[13219:1]: 1440 bound to 10.10.10.2:1440 2006.03.07 08:30:20 LOG7[13220:1]: Created pid file /usr/local/var/stunnel/stunnel.pid 2006.03.07 08:30:20 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:46 LOG7[13220:1]: 1440 accepted FD=7 from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:46 LOG7[13220:1]: Context 2 created 2006.03.07 08:31:46 LOG7[13220:2]: Context swap: 1 -> 2 2006.03.07 08:31:46 LOG7[13220:2]: 1440 started 2006.03.07 08:31:46 LOG7[13220:2]: FD 7 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: FD 9 in non-blocking mode 2006.03.07 08:31:46 LOG7[13221:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13221:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:46 LOG6[13220:0]: Child process 13221 finished with code 0 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(INHUP) 2006.03.07 08:31:46 LOG7[13220:2]: Connection from 10.10.10.100:1049 permitted by libwrap 2006.03.07 08:31:46 LOG5[13220:2]: 1440 connected from 10.10.10.100:1049 2006.03.07 08:31:46 LOG7[13220:2]: FD 8 in non-blocking mode 2006.03.07 08:31:46 LOG7[13220:2]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: waiting 10 seconds 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 10 second(s) for 3 file descriptor(s) 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:46 LOG7[13220:0]: CONTEXT 2, FD=8, (INOUT)->(OUT) 2006.03.07 08:31:46 LOG7[13220:2]: connect_wait: connected 2006.03.07 08:31:46 LOG7[13220:2]: Remote FD=8 initialized 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): before/connect initialization 2006.03.07 08:31:46 LOG7[13220:2]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:46 LOG7[13220:0]: Waiting 300 second(s) for 3 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:1]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:1]: Context swap: 2 -> 1 2006.03.07 08:31:47 LOG7[13220:1]: Current context: 1 2006.03.07 08:31:47 LOG7[13220:1]: 1440 accepted FD=9 from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:1]: Creating a new context 2006.03.07 08:31:47 LOG7[13220:1]: Context 3 created 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 1 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: 1440 started 2006.03.07 08:31:47 LOG7[13220:3]: FD 9 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: FD 11 in non-blocking mode 2006.03.07 08:31:47 LOG7[13222:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13222:0]: CONTEXT 3, FD=11, (OUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: Cleaning up the signal pipe 2006.03.07 08:31:47 LOG6[13220:0]: Child process 13222 finished with code 0 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(INHUP) 2006.03.07 08:31:47 LOG7[13220:3]: Connection from 10.10.10.100:1050 permitted by libwrap 2006.03.07 08:31:47 LOG5[13220:3]: 1440 connected from 10.10.10.100:1050 2006.03.07 08:31:47 LOG7[13220:3]: FD 10 in non-blocking mode 2006.03.07 08:31:47 LOG7[13220:3]: 1440 connecting 192.168.19.50:1078 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: waiting 10 seconds 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 10 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (INOUT)->(OUT) 2006.03.07 08:31:47 LOG7[13220:3]: connect_wait: connected 2006.03.07 08:31:47 LOG7[13220:3]: Remote FD=10 initialized 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): before/connect initialization 2006.03.07 08:31:47 LOG7[13220:3]: SSL state (connect): SSLv3 write client hello A 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 299 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:31:47 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:31:47 LOG7[13220:2]: Current context: 2 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:31:47 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:31:47 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:31:47 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:31:47 LOG7[13220:3]: Current context: 3 2006.03.07 08:31:47 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:02 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:02 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 285 second(s) for 4 file descriptor(s) 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:02 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:02 LOG7[13220:3]: CONTEXT 2, FD=8, (IN)->() 2006.03.07 08:32:02 LOG7[13220:3]: Context swap: 2 -> 3 2006.03.07 08:32:02 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:02 LOG7[13220:0]: Waiting 300 second(s) for 4 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 2, FD=8, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:2]: CONTEXT 3, FD=10, (IN)->() 2006.03.07 08:32:17 LOG7[13220:2]: Context swap: 3 -> 2 2006.03.07 08:32:17 LOG7[13220:2]: Current context: 2 2006.03.07 08:32:17 LOG7[13220:2]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:2]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:2]: 1440 finished (1 left) 2006.03.07 08:32:17 LOG5[13220:2]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:2]: Context 2 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting 285 second(s) for 3 file descriptor(s) 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=4, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 1, FD=6, (IN)->() 2006.03.07 08:32:17 LOG7[13220:0]: CONTEXT 3, FD=10, (IN)->(IN) 2006.03.07 08:32:17 LOG7[13220:3]: Context set: 2 (dropped) -> 3 2006.03.07 08:32:17 LOG7[13220:3]: Current context: 3 2006.03.07 08:32:17 LOG7[13220:3]: Releasing context 2 2006.03.07 08:32:17 LOG7[13220:3]: SSL alert (write): fatal: handshake failure 2006.03.07 08:32:17 LOG3[13220:3]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2006.03.07 08:32:17 LOG7[13220:3]: 1440 finished (0 left) 2006.03.07 08:32:17 LOG5[13220:3]: stack_info: size=65536, current=4208 (6%), maximum=4208 (6%) 2006.03.07 08:32:17 LOG7[13220:3]: Context 3 closed 2006.03.07 08:32:17 LOG7[13220:0]: Waiting -1 second(s) for 2 file descriptor(s) --Matteo D'Amato

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Kevin A. McGrail 07 Mar '06

07 Mar '06

This sounds like exactly what stunnel does. You want to have host A talk to Server A via SSL so you run stunneld on it. Then it will redirect that connection to server B via non-SSL. What protocol are we talking about here? Let's assume it's https: On Server A, setup stunnel with a conf file with these lines (as well as many others surely) [https] accept = 443 connect = serverb.smartbox.ca:80 Then your host connects to server a, negotiates SSL and the information is sent to the other server. I think your biggest issue is going to be the certificate on Server A so that the Host connects to the Server without certificate issues. Sincerely, Kevin A. McGrail aka KAM > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 7:20 PM > To: stunnel-users(a)mirt.net > Subject: RE: [stunnel-users] Re: Can stunnel do this? > > Stunnel can only be installed on Server A > > > > --Matteo D'Amato > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:[email protected]] On Behalf Of Matteo D'Amato > Sent: Monday, March 06, 2006 5:58 PM > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Re: Can stunnel do this? > > Hi, > Can stunnel do this > > > Host A ---------> Server A ---------> Server B > SSL unencrypted > > This looks like the opposite of what stunnel does. I have a > host that speaks SSL that needs to talk to a server that does > not and the host must always initiate the connection. Any > ideas if this can be done with stunnel or is there another > way to do this. Thanks

1 0

RE: [stunnel-users] Re: Can stunnel do this?
by Matteo D'Amato 07 Mar '06

07 Mar '06

Stunnel can only be installed on Server A --Matteo D'Amato -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Matteo D'Amato Sent: Monday, March 06, 2006 5:58 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Re: Can stunnel do this? Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: Can stunnel do this?
by Matteo D'Amato 06 Mar '06

06 Mar '06

Hi, Can stunnel do this Host A ---------> Server A ---------> Server B SSL unencrypted This looks like the opposite of what stunnel does. I have a host that speaks SSL that needs to talk to a server that does not and the host must always initiate the connection. Any ideas if this can be done with stunnel or is there another way to do this. Thanks -- Matteo D'Amato Smartbox Equipment Inc

1 0

configure problem in 4.14
by MeeAGhost 06 Mar '06

06 Mar '06

Whether --enable-dh is defined or not the stunnel created certificates created during make-install will include DH support. This is because the USE_DH variable in tools/Makefile is undefined which in turn causes the test portion of the install-data-local section of the tools/Makefile below to fail test $(USE_DH) -eq 0 || $(openssl) gendh $$RND 512 >> stunnel.pem; \ $(openssl) x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ${INSTALL} -m 600 stunnel.pem $(DESTDIR)$(confdir)/stunnel.pem; \ rm stunnel.pem; \ The test fails with this error message "/bin/bash: test: -eq: unary operator expected" since USE_DH is empty (undefined). I looked at the dh section of the configure script and it appears USE_DH is being set to 1 when --enable-dh is defined. However, USE_DH=1 is only in the DEFS section of tools/Makefile and not actually setting the value of USE_DH variable. I read in the change notes (from several years ago) that dh was disabled by default. I have been running stunnel for the past 3-4 years but have since I initially installed it back then I have been upgrading and therefore the above section of the tools\Makefile was skipped since I already had certificates defined. I went to install on a new box today and found the above 'problem'. So I am not sure how long this has been like this. Before I tried to figure out what is "wrong" I wanted to see if others have noticed this. I have seen this on Solaris 9 and in the cygwin 1.5.19.

2 1

tappipe 1.02 (stable!) released
by Michal Trojnara 03 Mar '06

03 Mar '06

Dear Users, The stable version of my VPN for stunnel/Linux is ready for download here: ftp://ftp.mirt.net/tappipe/ AFAIK it's the shortest (only 356 lines in C language) and probably one of the easiest to setup VPNs ever. Here is the ChangeLog entry: * version 1.02 2006.03.03, status: functional, stable - retransmission rate limiting algoritm improved - some minor bugfixes Could someone contribute a manual page? 8-) Best regards, Mike

1 0

Zombie problem with stunnel-4.11
by Ole Husgaard 01 Mar '06

01 Mar '06

Hi, I am trying to set up stunnel to be invoked from xinetd.d to secure pop3 access, and I'm having problems with zombie processes. It looks like stunnel does not clean up after the pop3 session: 31679 ? Ss 0:00 xinetd -stayalive -reuse -pidfile /var/run/xinetd.pid 32049 ? Ss 0:00 \_ stunnel /etc/pop3s/stunnel.cnf 32050 ? Z 0:00 \_ [ipop3d] <defunct> The contents of my stunnel.cnf file is: CAfile = /var/www/html/ca-cert.crt CRLfile = /var/www/html/ca-crl.crl cert = /etc/pop3s/pop3s.cert key = /etc/pop3s/pop3s.key verify = 2 exec = /usr/sbin/ipop3d execargs = ipop3d I use a non-standard port 997 for the service, so I have the line pop3s-eXerp 997/tcp in my /etc/services file. The xinetd configuration file for the service is: service pop3s-eXerp { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = /etc/pop3s/stunnel.cnf log_on_success += USERID log_on_failure += USERID } I have searched the net, but have not seen anybody else who have had this problem. Does anybody have an idea of what is causing this problem, or what I can do to work around it? Best Regards, Ole Husgaard.

2 1

Client setup
by Ting 21 Feb '06

21 Feb '06

Hello all, Wonder if anybody could advise. I have a client tn3270 application running on Solaris 2.8. Currently, it is using clear text to communicate with tn3270 server. Now, I need to run tn3270 with SSL. If I install stunnel in the Solaris 2.8 box to act as a wrapper. 1. Do I run the stunnel as a client only ? Is the command: stunnel -c -d <port1> -r <tn3270server>:<port2> a. Is port1 the original port where client tn3270 application sends to server ? b. Is port2 the same as port1 ? c. Alternatively, am I supposed to change the client tn3270 application to direct the data to a new port X, then port1 = X, while port2 is the port where the server is listening on. Thank you in advance. Warm Regards, TW --------------------------------- Do you Yahoo!? Yahoo! Movies - Search movie info and celeb profiles and photos.

2 1

Choosing local 'source' IP?
by Don Werve 20 Feb '06

20 Feb '06

Ok, so here's the problem: I've got stunnel handling SSL for a web-based service that is otherwise too stupid to be able to talk https. Unfortunately, I need to set up a redirection rule inside this service that bounces people back to the https:// page if they try to come in over http. Since said service isn't managing its own SSL, I have no solid way of determining which connections are wrappered by stunnel and which connections come in over the wire, and if I bounce stunnel connections, I end up in an infinite loop. Fortunately, all stunnel connections give a REMOTE_IP of the second ethernet adapter of the host system, which is good. My question is, how do I configure stunnel to 'force' this behavior? E.g., I want to explicitly specify in stunnel.conf 'Connect to the service for which you are acting as a wrapper from *this* IP/interface'. I've tried the 'local = ' option and setting socket flags for 'l' and 'r', and while they don't break anything, I can't use them to force a connection from any other adapter, so I don't think they are doing what I need. This wouldn't be an issue, either, except I don't know how stunnel determines this, and I don't want to (at some point in the future) have things 'magically change' (read: break horribly). Thanks-in-advance! -- Don Werve <donw(a)iradeon.net> Chief Systems Administrator / Systems Architect

2 1

RE: question about stunnel setup
by Anthony Cicalla 15 Feb '06

15 Feb '06

Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. Ok my question is from above it says to create one syslog-ng-client.pem file per client. 1)Do the names for each of these need to remain syslog-ng-client.pem or can they have names that reflect the host that they are on? 2) if they all need to keep that name do just move the client file to one client/host and then delete it from the server then move on to create the next?

2 1

stunnel and syslog
by Bart Somers 10 Feb '06

10 Feb '06

Hi to all, We recently ran in to a problem using stunnel on our AIX 5.2 machines. This is our situation: we are running stunnel as a client to protect http (and a proprietary protocol) traffic between our company and a customer. We are using client-athentication to grant access to the server and on our client-side we validate the server-certificates. This all works fine. Due to new security-restrictions, we are moving all our private-key material into HSM-boxes, in our case these are nCipher nShield HSM's. According to the documantion on there website ( http://active.ncipher.com ) we builded openssl nCipher-enabled. Based on this openssl-version, we builded stunnel. All the build-options are shown below in this message. The compiler used is the IBM C compiler. According to the manuals from stunnel we needed to put in an extra line to the config-file which shows "engine = chil" (chil is the Cryptographic Hardware Interface Library, the way the nCipher HSM's are known to openssl) After all this, we created key's in the hsm, using the nCipher tools and loaded them into stunnel (using this method you get a "pseudo-pem-file", which is actually a reference to the hardware-key). Fire-up stunnel using the commands from nCipher to preload the key's and we are all good to go! When this all seems to work very stable after a few months, with thousands of connections and ditto megabytes transfered, we wanted to have all the logging to our syslogserver (it runs syslog-ng) and this is the place where my problem hits in: When commenting-out the option "output = /home/bart/stl/var/stunnel.log" and restarting stunnel, stunnel dies after the first or second connection, leaving no logging, corefiles or whatever behind. Using plain key's (so no HSM, but with the same build which is aware of the HSM), syslog is no problem. Using HSM-key's with plaintext logfiles (no syslog) works also excellent. As i don't have any ideas anymore where to search, i want to ask you if somebody ever have seen this behaviour or knows where it could be caused by. (And maybe how to solve it....) Thanks in advance! Best regards, Bart Somers. ############################# # Build- and config-options # ############################# bart@server1:./stunnel -version stunnel 4.11 on powerpc-ibm-aix5.2.0.0 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.8 05 Jul 2005 Global options cert = home/bart/stl/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /home/bart/stl/etc/stunnel/stunnel.pem pid = /home/bart/stl/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds bart@server1:./openssl version OpenSSL 0.9.8 05 Jul 2005 compile-options: Openssl: $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./config --prefix=/home/bart/stl –DNFast –ldl make and make install Stunnel: $ export CPPFLAGS="-I/home/bart/stl/include" $ export LDFLAGS="-L/opt/nfast/toolkits/hwcrhk" $ ./configure –-prefix=/home/bart/stl –-with-ssl=/home/bart/stl -–disable-libwrap make and make install Config-file: Include engine = chil Start-up: $ with-nfast –f /home/bart/stl/tmp/ff /home/bart/stl/sbin/stunnel /home/bart/stl/etc/stunnel/stunnel.conf Relevant information from the config-file: engine = chil cert = /home/bart/stl/etc/stunnel/my-key.pem key = /home/bart/stl/etc/stunnel/my-key-hsm.pem ;(no chroot options used) pid = /prj/stl_004/tmp/test/stunnel-client.pid debug = 7 ; output = /home/bart/stl/var/stunnel.log # when in comment, problems! client = yes [test] accept = 9400 connect = 10.10.10.10:443 All other values are the default from the example.

2 4

transparent mode in linux
by Jesse Small 10 Feb '06

10 Feb '06

Hello, I am having trouble with the 'transparent = yes' option in my configuration file. Basically the goal is to see the IP address of the client connecting to our server, but I am getting this error in the log file: bind transparent: Cannot assign requested address (99) Failed to initialize remote connection After searching through the stunnel archives, I saw that this option (-T back then) was supported only up to the Linux 2.2 kernel, but didn't work on the 2.4 kernel. All the messages I read through were a few years old. I am using Fedora Core 4 with a 2.6 kernel, and wanted to see if there were any updates and if it was now possible to see the client's IP address. Otherwise all incoming connections appear as if from localhost. We are using stunnel v4.14. Thanks for your help, Jesse

2 1

stunnel closing connections with RST ?
by sergei 09 Feb '06

09 Feb '06

I'm setting up load-balanced service requiring stunnel with SSL on its front end. There are two hosts behind load balancer running stunnel . Service behind stunnel does not speak SSL. Every few minutes load balancer checks if those stunnels are still alive by opening tcp connection to stunnel listening port. Now problem is that stunnel closes those test connections with RST and load balancer takes it as that host is dead. This is without "client = yes" option because service does not speak SSL load-balancer -> stunnel-host TCP D=1234 S=33007 Syn stunnel-host -> load-balancer TCP D=33007 S=1234 Syn Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Ack load-balancer -> stunnel-host TCP D=1234 S=33007 Fin Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Ack stunnel-host -> load-balancer TCP D=33007 S=1234 Rst On the other hand with client=yes everything works fine load-balancer -> stunnel-host TCP D=123 S=33010 Syn stunnel-host -> load-balancer TCP D=33010 S=123 Syn Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack load-balancer -> stunnel-host TCP D=123 S=33010 Fin Ack stunnel-host -> load-balancer TCP D=33010 S=123 Fin Ack load-balancer -> stunnel-host TCP D=123 S=33010 Ack Is there any way to make stunnel without "client = yes" close connection "normal way" with FIN instead of RST ? stunnel is last version, load balancer is some older F5 BigIP thanks sergei

3 7

certificate root chain
by Olivier twist 09 Feb '06

09 Feb '06

Hello, I've already sent a message for my problem but no answer. I have a server certificate signed by GlobalSign. I don't want to use client certificate. But if I don't put the certification chain on the CAFILE of stunnel and don't set verify at 1, stunnel doesn't check the server certification chain and the server certificate appears broken on client side !!! I've post this problem on the stunnel mailing list but you tell me that if I don't use client certificate I don't have to set verify at 1. But it doesn't work, and why GlobalSign and others explain how to install server certificatation chain on servers like apache mod ssl?(see http://support.globalsign.net/en/serversign/apachemodssl.cfm) when I read this help file I suppose that the ssl protocol on server side makes a check of server certificate, and that's the reason why the certificate chain appears broken or not on client side. My current ugly solution is to set verify at 1, in this case, on client side, the certificate appears good and not broken but... a dialog box appears and ask for client certificate and some plugin like flash doesn't support that. i use stunnel 4.14 stunnel.conf: cert = c:\certif\inTest.crt key = c:\certif\inTest.key socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 1 CAfile = c:\certif\ca.pem ;client = yes [https] accept = 443 connect = 127.0.0.1:901 TIMEOUTclose = 0 [rtmps] accept = 80 connect = 127.0.0.1:900 TIMEOUTclose = 0 Could anybody gives me a support? Thx Oliver

3 3

Re: [stunnel-users] certificate root chain
by Hans Werner Strube 09 Feb '06

09 Feb '06

Olivier twist wrote: > I have a server certificate signed by GlobalSign. I don't want to use client > certificate. > But if I don't put the certification chain on the CAFILE of stunnel and > don't set verify at 1, stunnel doesn't check the server certification chain > and the server certificate appears broken on client side !!! ... > cert = c:\certif\inTest.crt > key = c:\certif\inTest.key ... > CAfile = c:\certif\ca.pem AFAIK the whole certificate chain from your server certificate up to the CA certificate should be in inTest.crt (simply concatenate the PEM files). The CAfile would be needed for client verification only.

1 0

RE: [stunnel-users] stunnel help
by Anthony Cicalla 07 Feb '06

07 Feb '06

I sent an email last week for help with a stunnel setup. I am attempting to send syslog messages via a snare agent through stunnel to a fedora core 4 box with syslog-ng installed. I have been able to get one machine to successfully log to the fedora box out of 4. I set these boxes up the same way and I am confused as to why one is working and the others aren't . This is my stunnel.conf file for the clients cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.185.60:5140 This is my stunnel.conf file for the server cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.185.60:5140 connect = 127.0.0.1:514 This is my syslog-ng.conf file on the server options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; The snare agents are configured to send logs to 127.0.0.1 514. Any thoughts or idea's would be great. sincerely, Anthony -----Original Message----- From: Michal Trojnara [mailto:[email protected]] Sent: Tuesday, February 07, 2006 1:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] stunnel closing connections with RST ? sergei wrote: > Is there any way to make stunnel without "client = yes" > close connection "normal way" with FIN instead of RST ? Stunnel resets connections for a reason. Probably it was reset by the other peer. Check your stunnel log files for details. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Multiple Instances of Same Application, Different Ports
by Steve Ricketts 06 Feb '06

06 Feb '06

1 0

stunnel not connecting to port 139 on server
by Neil Aggarwal 05 Feb '06

05 Feb '06

Hello: I have two windows machines. I am trying to connect to a shared drive on the server over an stunnel connection following the instructions on this page: http://research.lumeta.com/ches/cheap/stunnelsolution.html The connection from the client seems to connect to the server, but the server-side stunnel seems to be getting a timeout when it attempts to connect to port 139. I am able to map the network drive locally, so I am surprised it is not able to connect. Here is the log from stunnel on the server: 2006.02.04 18:22:17 LOG5[2116:3068]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:22:17 LOG7[2116:3968]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:22:17 LOG6[2116:3968]: PRNG seeded successfully 2006.02.04 18:22:17 LOG7[2116:3968]: Certificate: stunnel.pem 2006.02.04 18:22:17 LOG7[2116:3968]: Key file: stunnel.pem 2006.02.04 18:22:17 LOG5[2116:3968]: No limit detected for the number of clients 2006.02.04 18:22:17 LOG7[2116:3968]: FD 168 in non-blocking mode 2006.02.04 18:22:17 LOG7[2116:3968]: SO_REUSEADDR option set on accept socket 2006.02.04 18:22:17 LOG7[2116:3968]: netDrives bound to 0.0.0.0:2139 2006.02.04 18:24:49 LOG7[2116:3968]: netDrives accepted FD=188 from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:49 LOG7[2116:3968]: New thread created 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives started 2006.02.04 18:24:49 LOG7[2116:2224]: FD 188 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: TCP_NODELAY option set on local socket 2006.02.04 18:24:49 LOG5[2116:2224]: netDrives connected from 192.168.1.247:1334 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): before/accept initialization 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write certificate A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write server done A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read client key exchange A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:49 LOG7[2116:2224]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:49 LOG7[2116:2224]: 1 items in the session cache 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects (SSL_connect()) 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 client renegotiatations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects (SSL_accept()) 2006.02.04 18:24:49 LOG7[2116:2224]: 1 server connects that finished 2006.02.04 18:24:49 LOG7[2116:2224]: 0 server renegotiatiations requested 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache hits 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache misses 2006.02.04 18:24:49 LOG7[2116:2224]: 0 session cache timeouts 2006.02.04 18:24:49 LOG6[2116:2224]: SSL accepted: new session negotiated 2006.02.04 18:24:49 LOG6[2116:2224]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:49 LOG7[2116:2224]: FD 216 in non-blocking mode 2006.02.04 18:24:49 LOG7[2116:2224]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:49 LOG7[2116:2224]: connect_wait: waiting 10 seconds 2006.02.04 18:24:59 LOG7[2116:3968]: netDrives accepted FD=236 from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3968]: Creating a new thread 2006.02.04 18:24:59 LOG7[2116:3968]: New thread created 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives started 2006.02.04 18:24:59 LOG7[2116:3544]: FD 236 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:3544]: TCP_NODELAY option set on local socket 2006.02.04 18:24:59 LOG5[2116:3544]: netDrives connected from 192.168.1.247:1336 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): before/accept initialization 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read client hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write server hello A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write change cipher spec A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 write finished A 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 flush data 2006.02.04 18:24:59 LOG7[2116:3544]: SSL state (accept): SSLv3 read finished A 2006.02.04 18:24:59 LOG7[2116:3544]: 1 items in the session cache 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects (SSL_connect()) 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 client renegotiatations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects (SSL_accept()) 2006.02.04 18:24:59 LOG7[2116:3544]: 2 server connects that finished 2006.02.04 18:24:59 LOG7[2116:3544]: 0 server renegotiatiations requested 2006.02.04 18:24:59 LOG7[2116:3544]: 1 session cache hits 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache misses 2006.02.04 18:24:59 LOG7[2116:3544]: 0 session cache timeouts 2006.02.04 18:24:59 LOG6[2116:2224]: connect_wait: s_poll_wait timeout 2006.02.04 18:24:59 LOG6[2116:3544]: SSL accepted: previous session reused 2006.02.04 18:24:59 LOG3[2116:2224]: Failed to initialize remote connection 2006.02.04 18:24:59 LOG7[2116:3544]: FD 216 in non-blocking mode 2006.02.04 18:24:59 LOG7[2116:2224]: netDrives finished (1 left) 2006.02.04 18:24:59 LOG7[2116:3544]: netDrives connecting 127.0.0.1:139 2006.02.04 18:24:59 LOG7[2116:3544]: connect_wait: waiting 10 seconds 2006.02.04 18:25:09 LOG6[2116:3544]: connect_wait: s_poll_wait timeout 2006.02.04 18:25:09 LOG3[2116:3544]: Failed to initialize remote connection 2006.02.04 18:25:09 LOG7[2116:3544]: netDrives finished (0 left) Here is the stunnel.conf file from the server: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [netDrives] accept = 2139 connect = 139 In case you need it, here is the stunnel log from the client: 2006.02.04 18:23:43 LOG5[3236:2376]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.04 18:23:43 LOG7[3236:324]: RAND_status claims sufficient entropy for the PRNG 2006.02.04 18:23:43 LOG6[3236:324]: PRNG seeded successfully 2006.02.04 18:23:43 LOG7[3236:324]: Certificate: stunnel.pem 2006.02.04 18:23:43 LOG7[3236:324]: Key file: stunnel.pem 2006.02.04 18:23:43 LOG5[3236:324]: No limit detected for the number of clients 2006.02.04 18:23:43 LOG7[3236:324]: FD 200 in non-blocking mode 2006.02.04 18:23:43 LOG7[3236:324]: SO_REUSEADDR option set on accept socket 2006.02.04 18:23:43 LOG7[3236:324]: netDrives bound to 222.222.222.222:139 2006.02.04 18:24:42 LOG7[3236:324]: netDrives accepted FD=220 from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:42 LOG7[3236:324]: New thread created 2006.02.04 18:24:42 LOG7[3236:572]: netDrives started 2006.02.04 18:24:42 LOG7[3236:572]: FD 220 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on local socket 2006.02.04 18:24:42 LOG5[3236:572]: netDrives connected from 192.168.1.247:1333 2006.02.04 18:24:42 LOG7[3236:572]: FD 252 in non-blocking mode 2006.02.04 18:24:42 LOG7[3236:572]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: waiting 10 seconds 2006.02.04 18:24:42 LOG7[3236:572]: connect_wait: connected 2006.02.04 18:24:42 LOG7[3236:572]: Remote FD=252 initialized 2006.02.04 18:24:42 LOG7[3236:572]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): before/connect initialization 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server certificate A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read server done A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write client key exchange A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:42 LOG7[3236:572]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:42 LOG7[3236:572]: 1 items in the session cache 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects (SSL_connect()) 2006.02.04 18:24:42 LOG7[3236:572]: 1 client connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 client renegotiatations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects (SSL_accept()) 2006.02.04 18:24:42 LOG7[3236:572]: 0 server connects that finished 2006.02.04 18:24:42 LOG7[3236:572]: 0 server renegotiatiations requested 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache hits 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache misses 2006.02.04 18:24:42 LOG7[3236:572]: 0 session cache timeouts 2006.02.04 18:24:42 LOG6[3236:572]: SSL connected: new session negotiated 2006.02.04 18:24:42 LOG6[3236:572]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2006.02.04 18:24:52 LOG3[3236:572]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:24:52 LOG7[3236:324]: netDrives accepted FD=276 from 192.168.1.247:1335 2006.02.04 18:24:52 LOG5[3236:572]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:24:52 LOG7[3236:324]: Creating a new thread 2006.02.04 18:24:52 LOG7[3236:572]: netDrives finished (0 left) 2006.02.04 18:24:52 LOG7[3236:324]: New thread created 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives started 2006.02.04 18:24:52 LOG7[3236:1336]: FD 276 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on local socket 2006.02.04 18:24:52 LOG5[3236:1336]: netDrives connected from 192.168.1.247:1335 2006.02.04 18:24:52 LOG7[3236:1336]: FD 248 in non-blocking mode 2006.02.04 18:24:52 LOG7[3236:1336]: netDrives connecting 192.168.1.10:2139 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: waiting 10 seconds 2006.02.04 18:24:52 LOG7[3236:1336]: connect_wait: connected 2006.02.04 18:24:52 LOG7[3236:1336]: Remote FD=248 initialized 2006.02.04 18:24:52 LOG7[3236:1336]: TCP_NODELAY option set on remote socket 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): before/connect initialization 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write client hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read server hello A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 read finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write change cipher spec A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 write finished A 2006.02.04 18:24:52 LOG7[3236:1336]: SSL state (connect): SSLv3 flush data 2006.02.04 18:24:52 LOG7[3236:1336]: 1 items in the session cache 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects (SSL_connect()) 2006.02.04 18:24:52 LOG7[3236:1336]: 2 client connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 client renegotiatations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects (SSL_accept()) 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server connects that finished 2006.02.04 18:24:52 LOG7[3236:1336]: 0 server renegotiatiations requested 2006.02.04 18:24:52 LOG7[3236:1336]: 1 session cache hits 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache misses 2006.02.04 18:24:52 LOG7[3236:1336]: 0 session cache timeouts 2006.02.04 18:24:52 LOG6[3236:1336]: SSL connected: previous session reused 2006.02.04 18:25:02 LOG3[3236:1336]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2006.02.04 18:25:02 LOG5[3236:1336]: Connection reset: 72 bytes sent to SSL, 0 bytes sent to socket 2006.02.04 18:25:02 LOG7[3236:1336]: netDrives finished (0 left) Here is the stunnel.conf file from the client: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [netDrives] accept = 222.222.222.222:139 connect = tcServer.crcBusinessServices.com:2139 Any ideas what could be wrong? Thanks, Neil -- Neil Aggarwal, JAMM Consulting, (214) 986-3533, www.JAMMConsulting.com FREE! Valuable info on how your business can reduce operating costs by 17% or more in 6 months or less! http://newsletter.JAMMConsulting.com

1 0

tappipe 1.01 released
by Michal Trojnara 04 Feb '06

04 Feb '06

Here is the ChangeLog entry: * version 1.01 2006.02.04, status: functional, not proven to be stable - TUN changed to TAP (project renamed from tunpipe to tappipe) - TCP-over-TCP meltdown problem fixed http://sites.inka.de/sites/bigred/devel/tcp-tcp.html - important bugfixes Download site: ftp://stunnel.mirt.net/tappipe/ Best regards, Mike

1 0

Stunnel with ntsyslog on windows 2000 forwarding to syslog-ng on fedora core 4 with stunnel in the middle.
by Anthony Cicalla 03 Feb '06

03 Feb '06

Website questions answered first 1) ntsyslog(on windows 2000 pro) is not connecting through stunnel to (fedora core 4) syslog-ng daemon. 2) latest version of stunnel just downloaded it. 3)stunnel syslog-ng -f /etc/syslog-ng.conf 4)ran the command but got no output. (stunnel /etc/stunnel/stunnel.conf -f -D -7) 5)ran the command and it exectuted as above but still got no optput ran (stunnel /etc/stunnel/stunnel.conf -V) 6)Linux echelon.bankserv.com 2.6.11-1.1369_FC4 #1 Thu Jun 2 22:55:56 EDT 2005 i686 i686 i386 GNU/Linux 7)sry I'm a noob and don't know how to get this. I am from the windows side of the house. If you need it send me the command and I will get you the output. 8)Using built-in specs. Target: i386-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,java,f95,ada --enable-java-awt=gtk --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --host=i386-redhat-linux Thread model: posix gcc version 4.0.0 20050519 (Red Hat 4.0.0-8) 9)This is the latest version for fedora core 4. I downloaded the packages for openssl and ran the updater. I am setting up centralized logging with stunnel, syslog-ng, ntsyslog. Following the directions from these two links. <http://www.stunnel.org/examples/syslog-ng.html> <http://www.monitorware.com/Common/en/Articles/eventlog-stunnel-syslog.php> Encrypting traffic to a remote syslog-ng server including SSL peer authentication 1. Install stunnel and syslog-ng on all machines. 2. Create certificates for all machines. On RedHat 9 and similar machines, you can do the following as root: # cd /etc/pki/tls/certs # make syslog-ng-server.pem # make syslog-ng-client.pem 3. Place copies of syslog-ng-server.pem on all machines in /etc/stunnel with one important alteration. The clients only need the certificate section of syslog-ng-server.pem. In other words, remove the private key section from syslog-ng-server.pem on all clients. Place every client's syslog-ng-client.pem in /etc/stunnel. For server, create a special syslog-ng-client.pem containing the certificate sections for all clients and place in /etc/stunnel. In other words, remove the private key sections from all syslog-ng-client.pem files and concatenate what is left to create server's special syslog-ng-client.pem. 4. Give only root ownership, read and write permissions for certificates. 5. On server, create /etc/stunnel/stunnel.conf containing the following replacing server IP address accordingly: cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.x.x.x:5140 connect = 127.0.0.1:514 On clients, create /etc/stunnel/stunnel.conf containing the following replacing server IP address accordingly: client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.x.x.x:5140 6. On server, create the following in /etc/syslog-ng.conf: options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1") port(514) max-connections(1));}; destination remoteclient {file("/var/log/remoteclient");}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; log {source(stunnel); destination(remoteclient);}; On clients, create the following in /etc/syslog-ng.conf: options {long_hostnames(off); sync(0);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; destination stunnel {tcp("127.0.0.1" port(514));}; log {source(src);destination(dest);}; log {source(src);destination(stunnel);}; (See syslog-ng documentation for more sophisticated syslog-ng.conf alternatives.) 7. Open necessary ports with regards to packet filtering and TCP wrappers. 8. On all machines, add the following lines to boot procedure and execute them now: # stunnel # syslog-ng -f /etc/syslog-ng.conf That was the unix side stunnel config. Copy the files to a location of your choice. If in doubt what you need, download the latest stunnel binary as well as the ZIP file with the openssl libararies. Place everything in the same directory, e.g. c:\bin\stunnel. Please note that the stunnel binary (eg. stunnel-4.04.exe) is the actual stunnel program and NOT a self-extracting exe program. Once you have done this, you only need to supply stunnel with a correct configuration file. You can use the one from the stunnel UNIX/Linux tutorial, step 5. Make sure that you not only copy over the config file but also the needed .PEM files. You probably need to change the pathes in the stunnel.conf file to reflect your local Windows directory structure. Once you have the config file ready, you can start the Windows stunnel. Please note that it by default starts interactively. If all goes well, there is a small icon in the icon tray. Double-Click it to get a status window. If something goes wrong, the status window automatically appears with a nice error message. AT THIS POINT I AM ABLE TO START STUNNEL WITH NO ERRORS SHOW UP BUT 0 ACTIVE TUNNELS. Let's assume all went well. What is left is that we must tell the event log monitor where to forward events to. Installation: Install the service by executing the following command: NTsyslog -install The service will be started automatically by the service control manager during system startup. You can start and stop the service manually from the Services Control Panel. By default the service runs under the LocalSystem account. The service can be configured to run as a local user with the following rights: * Log on as a service * Manage auditing and security log The user the service runs as can be configured in the NTsyslog Properties page which can be accessed through the Services Control Panel. A GUI tool, NTSyslogCtrl is provided to configure what types of messages are monitored and what priority to use for each type. The priority for each event log type controls the service and facility that the syslog message is sent to. Each log type has a seperate priority. If the priority for a particular key does not exist, as if you were upgrading, or using an old NTSyslogCtrl app, the default is 9, user.alert. Usually, syslog refers to a "facility" and "severity". These are combined in to a single value called "priority". To calculate the priorities from normal facility and severity codes: Take the numeric value for the facility, multiply by 8, and add the numeric value for the severity. Standard facility and severity values are: Facility: (0) kernel (12) ntp (1) user (13) log audit (2) mail (14) log alert (3) system (15) clock 2 (4) security/auth 1 (16) local 0 (5) syslog (17) local 1 (6) line printer (18) local 2 (7) news (19) local 3 (8) uucp (20) local 4 (9) clock 1 (21) local 5 (10) security/auth 2 (22) local 6 (11) ftp (23) local 7 Severity: (0) emergency (4) warning (1) alert (5) notice (2) critical (6) information (3) error (7) debug Note that facility 4, 9, 10, and 15 have different meaning on various systems. Please consult your system manual pages or syslogd documentation. Complete details are available in RFC 3164. See: <http://www.ietf.org/rfc/rfc3164.txt> The NTSyslog service must be stopped and restarted for the Registry settings to take effect. By default all messages are sent using the user.alert priority. Registry Settings: The NTSyslogCtrl program is the preferred method of configuring the registry. Editing the registry manually is not required when using the configuration tool. The syslog host is configured by creating the following Registry entry: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] "Syslog"="192.X.X.X" An additional syslog host may be configured for redundancy: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] "Syslog1"="" The syslog host can be specified by domain name (loghost.example.com) or by IP address (10.123.112.1). The types of event log messages sent to the syslog host can be configured by setting the dword value for each of the types of messages. All types with a non-zero value will be processed. The included registry file enables all event types for each event log: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\System] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Security] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Application] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 Version 1.11 and later supports user defined event logs. Simply add the appropriate sub-key and settings to the registry in the same format as the three standard event logs: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet\Syslog\Directory Service] "Information"=dword:00000001 "Information Priority"=dword:00000009 "Warning"=dword:00000001 "Warning Priority"=dword:00000009 "Error"=dword:00000001 "Error Priority"=dword:00000009 "Audit Success"=dword:00000001 "Audit Success Priority"=dword:00000009 "Audit Failure"=dword:00000001 "Audit Failure Priority"=dword:00000009 ok after all of this configuration and setup I get no syslogs in on the logging server. I did and ethereal capture and tested a few settings. If I point it directly to the syslog ip address it's still not connecting becuase it's trying to connect on port 514. The syslog server is running on port 5140 from the config. I can telnet to port 5140 with no problems. I can start the nt syslog service with the server's ip and see packets attempting to be sent this tells me that ntsyslog is working. When I go to examine stunnel I get 2006.02.02 10:18:06 LOG5[484:108]: stunnel 4.14 on x86-pc-mingw32-gnu WIN32+SELECT+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 2006.02.02 10:18:07 LOG5[484:652]: No limit detected for the number of clients 2006.02.02 11:38:18 LOG5[484:640]: 5140 connected from 127.0.0.1:1386 2006.02.02 11:38:27 LOG3[484:640]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol And that is where I am stuck... any help would be greatly appreciated. I check this regularly so I will reply or attempt suggestions pretty quickly and reply the results. I am still pretty new with linux so if you want me to do something or to get you some information put the commands or step of how to do it in the post. It will not only help me but it will help others behind me that might not know as much as well. I followed the instructions above which has the commands. I created the pem files and the conf files just as above althought there is not /etc/syslog-ng.conf on the windows machine. I still made the files but they are put in c:\bin\stunnel becuase syslog-ng doesn't run on windows. they reccommended snare of something of the like to forward the logs so I chose ntsyslog. Ntsyslog is setup exactly like the instructions say. like I said above stunnel starts without an error when I start the ntsyslog the error appears in the stunnel log. Client Stunnel.conf cert = C:\bin\stunnel\syslog-ng-server.pem CAfile = c:\bin\stunnel\syslog-ng-client.pem verify = 3 [5140] accept = 127.0.0.1:514 connect = 192.168.x.x:5140 Client Server stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5140] accept = 192.168.x.x:5140 connect = 127.0.0.1:514 syslog-ng.conf options { long_hostnames(off); sync(0); keep_hostname(yes); chain_hostnames(no); }; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; source stunnel {tcp(ip("127.0.0.1") port(514) max-connections(1));}; destination remoteclient {file("/var/log/remoteclient");}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; log {source(stunnel); destination(remoteclient);}; When you run the gui for ntsyslog it creates the registry entries so i did no have to create them. Client is on windows the server is the fedora core 4 box

1 0

tunpipe
by Michal Trojnara 03 Feb '06

03 Feb '06

Dear Users, For the last two days I was working on a VPN solution for stunnel. The early alpha version is ready for download here: ftp://stunnel.mirt.net/tunpipe/ Advantages: - based on proven strength of SSL encryption (much better than IPSec or any proprietary encryption protocol), - very clean and lightweight design, - very easy to configure. Disadvantages: - only works on GNU/Linux (can be ported to some other Unixes), - use of TCP is the main performance limitation. Aternative solutions: http://www.math.ucla.edu/~jimc/documents/vpn.html Suggestions and comments are welcome. Best regards, Mike

2 3

Encrypted tunnel for HTTP traffic?
by Robert Nicholson 01 Feb '06

01 Feb '06

Can anybody tell me if it's possible for stunnel to act as a local web proxy that simply encrypts my outgoing HTTP traffic and decrypts it on the way back in? Specifically is it still possible to block urls at the hosting provider with this approach and is all my browsing then safe from prying eyes? What I want is along the lines of a VPN solution but it sounds like stunnel can at least take care of my HTTP needs.

2 1

FQDN validation and checking within
by Nagasundaram, Sekhar 01 Feb '06

01 Feb '06

Mike: Given this: what is the best way for Stunnel to make authentication And authorization decisions based on information presented in the Certificate from the peer. My question comes from: how do I do level 3 Checking in a scalable manner when my order of magnitude is in the Thousands... Much thanks Sekhar ------------------------------- Message: 3 Date: Tue, 31 Jan 2006 09:51:06 +0100 From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> Subject: RE: [stunnel-users] FQDN validation and checking within STunnel To: <stunnel-users(a)mirt.net> Message-ID: <20060131085108.B053F1C130(a)linode.mirt.net> Content-Type: text/plain; charset="us-ascii" Nagasundaram, Sekhar wrote: > Is there a setting in Stunnel to do FQDN checking? DNS is not a secure protocol (http://www.securesphere.net/download/papers/dnsspoof.htm) Security should not be based on DNS checks. I'm not going to implement this feature. Best regards, Mike ------------------------------ Message: 4 Date: Tue, 31 Jan 2006 10:41:37 +0100 From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> Subject: RE: --with-threads=ucontext portability (was Re: [stunnel-users] stunnel4.x.x and IRIX) To: <stunnel-users(a)mirt.net> Message-ID: <20060131094139.33A011C17C(a)linode.mirt.net> Content-Type: text/plain; charset="iso-8859-1" Miloslav Trmac wrote: > I have just seen a crash at a similar place on x86_64. The apparent > cause is sthreads.c:116: > makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); arg is a void > *, but: > - the size is given as 1; it should be > (sizeof (arg) + sizeof (int) - 1) / sizeof (int) > because the "size" is defined as a number of int arguments > - it won't work anyway; makecontext () is defined to work only for > integer parameters. It is not possible to pass a pointer as > integers on x86_64, which uses registers to pass the first 6 > integer or pointer parameters. Are we still talking about IRIX? http://nixdoc.net/man-pages/IRIX/man3c/makecontext.3c.html I can't find any of mentioned limitations in the manual. Just the opposite: "the arguments that follow the argc parameter for makecontext are restricted to longs and pointers only". Best regards, Mike ------------------------------ _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users End of stunnel-users Digest, Vol 18, Issue 19 *********************************************

2 1

Encrypted tunnel for HTTP traffic?
by Robert Nicholson 01 Feb '06

01 Feb '06

Can anybody tell me if it's possible for stunnel to act as a local web proxy that simply encrypts my outgoing HTTP traffic and decrypts it on the way back in? Specifically is it still possible to block urls at the hosting provider with this approach and is all my browsing then safe from prying eyes? What I want is along the lines of a VPN solution but it sounds like stunnel can at least take care of my HTTP needs.

1 0

Stunnel Question /Feature request
by Mathias . 31 Jan '06

31 Jan '06

Hi everybody. Is it possible at the Client side specify where the Stunnel server should connect to? I mean. If I'm using stunnel both on the clisnt side and the Server side is it possible from within the Stunnel.conf file specify a destination at serverside that overides the "connect=" tag specified in the stunnel.conf file at the server side. This would make it possible to have two services accessible at the same port. I.e IIS using https (accessible from any browser) and a nother SSL, non-web, based service (accessible from a Stunnel client). Anyone that ever have thought about creating such a patch? /M

1 0

stunnel 4.x.x and IRIX
by Eric Haddix 31 Jan '06

31 Jan '06

I happened upon a user here that posted a couple of months ago(I think) who used IRIX and had successfully compiled stunnel. Any chance you're still around!?!? I get one of two things. Before I apply the patch, it will crash right after startup. No logs, just dumps core. After the patch, it starts and exits immediately. I can run it with -version, etc. and it seems to work fine. Anyone had this and/or know what can be done? Eric

3 10

FQDN validation and checking within STunnel
by Nagasundaram, Sekhar 31 Jan '06

31 Jan '06

All: Is there a setting in Stunnel to do FQDN checking? Level 3 checking requires a local copy of the Peer's certificate. When doing mutual authentication, I run into scalability issues when the devices Run into the thousands using Level3 validation. However, if Stunel was capable of doing FQDN checks, That would help while not requiring me to do level 3 checks (although that is probably better). Thanks Sekhar

2 1

stunnel errors on Solaris
by Kevin Mooney 27 Jan '06

27 Jan '06

Hello All, I am having some errors on a Solaris 8 machine with stunnel. Everything seems to be working fine, but I am just a little leary since it is under security violations. I couldn't get anything from google using the string Too many retries on SSL shutdown. I was curious if anyone has seen this before or if somebody might have an idea as to what this means. Thank You, Kevin Security Violations =-=-=-=-=-=-=-=-=-= Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown Jan 26 14:38:24 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11151]: Too many retries on SSL shutdown Jan 26 15:28:19 duvel stunnel: [ID 821868 daemon.notice] LOG5[23863:11180]: Too many retries on SSL shutdown

2 1

Stunnel and Forte Agent
by Malcolm William Mason 27 Jan '06

27 Jan '06

Hello to all, I have been using Stunnel to access News Groups at ATT.net to by-pass or tunnel through ATT's SSL for some time. I have run into trouble and I am getting a message "connection" failed. At first I thought that it was Stunnel and after deleting and re-installing Stunnel, I an getting the same RESULT. Was there an older version of Stunnel that worked and will the new, updated Stunnel not work or does it need to have some settings changed? Malcolm Mason MWM1(a)jhu.edu

1 0

Proxy Support and 4.15b2
by Ben Green 26 Jan '06

26 Jan '06

Greetings everyone, I have been working for a few days with Stunnel and have been trying to get it working with the proxy servers that filter all outbound traffic at work. I stumbled across 4.15b2 today and was able to get it all to work well to SSL enable telnet and fix through the connect protocol. I plan to use this in production if all goes well in dev, test, and qa over the next 2 months. I was not around on the list when the announcement went out for 4.15b2 on November 16th (found it in the archives). I'll get to my point, now. I am wondering how testing is going with 4.15b2. Is it going to be released as 4.15, soon? Has anyone put 4.15b2 in a production situation? Thanks. Ben Green

2 1

Win32 proxy enabled version
by Richard Houston 24 Jan '06

24 Jan '06

Hi all, I am looking for a windows version of stunnel with proxy server support. I need to use this from behind a Novel Boarder manager firewall. Also is there any documentation on the config file options? Thanks much in advance! +------------------------------------+ Best regards, -Richard Houston -R.L.H. Consulting -E-Mail rhouston(a)rlhc.net -WWW http://www.rlhc.net -Blog http://www.rlhc.net/blog/

1 0

Re: [stunnel-users] exclusively TLS
by Jesse Small 24 Jan '06

24 Jan '06

I've been working through the same problem as John, but I tried using Jan's solution by setting the options and still haven't been able to get it to work. On server1 I am running openssl s_server with tls-only specified: openssl s_server -accept 8443 -cert XDS_REG_HXTI.cer -key hxti1.key -tls1 On the client side (server2), I have stunnel set up as a client listening on localhost port 8100, and forwarding over to server1, port 8443. Then to test I run 'telnet localhost 8100' and see the error message from s_server: ACCEPT ERROR 16656:error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number:s3_srvr.c:683: shutting down SSL CONNECTION CLOSED In my stunnel.log file I can see this error message: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure So to me it still seems to be sending out a client hello in sslv3, despite my efforts to the contrary. Below are the pertinent parts of my stunnel_client.conf file. Any help you could give would be greatly appreciated. Thanks, Jesse ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 [toOtherServer] accept = 8100 connect = devapp:8443 -----Original Message----- From: Jan Meijer [mailto:[email protected]] Sent: Friday, January 20, 2006 5:20 PM To: Moehrke, John (GE Healthcare) Cc: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] exclusively TLS On Fri, 20 Jan 2006, Moehrke, John (GE Healthcare) wrote: > It is not the list of ciphers that I want to choose from. We are indeed > using a select set of ciphers and that seems to be working fine. My > problem is that when stunnel connects to the server it is trying sslv3, > and this causes an error as the server is only supporting TLS. I could > easily be wrong... Ah, that way. options = SSL_options OpenSSL library options The parameter is the OpenSSL option name as described in the SSL_CTX_set_options(3ssl) manual, but without SSL_OP_ prefix. Several options can be used to specify multiple options. For example for compatibility with erroneous Eudora SSL implementation the following option can be used: options = DONT_INSERT_EMPTY_FRAGMENTS Check the SSL_CTX_set_options manpage, it says -amongst other things-: SSL_OP_NO_SSLv2 Do not use the SSLv2 protocol. SSL_OP_NO_SSLv3 Do not use the SSLv3 protocol. SSL_OP_NO_TLSv1 Do not use the TLSv1 protocol. That ought to do the trick I'd say. Let us know if it did :) Jan -- http://www.surfnet.nl/organisatie/jame

1 0

ad tdions
by Malcolm William Mason 23 Jan '06

23 Jan '06

I am, apparently on this But how do I post to it as others seen to. Pro Posterioribus

1 0

Looking for a job in UK or Ireland
by Michal Trojnara 23 Jan '06

23 Jan '06

Hi, I hope you don't mind this time I'll use stunnel mailing lists for something personal. I've just updated my Resume: http://mike.mirt.net/cv-en.pdf Do you know of interesting job openings? Possibly as an architect or in a similar position. Best regards, Mike

1 0

https to http proxy is buggy with IE
by Glen 22 Jan '06

22 Jan '06

Hi Everyone, I am trying to use stunnel to do the ssl portion for the web server. Mainly because the certificate I have is easy to setup in stunnel (was originally created for an openssl based serer) and the web server supports it's own propriatery cert format which I would like to avoid having to convert to. I have it working fine with all browsers except for the buggy Internet Explorer. With internet explorer anything requiring a page redirect fails (from viewing the logs it appears the socket gets closed before the redirect is finished resulting in a blank page being sent to the browser. I have tried the TIMEOUTclose = 0 but that hasn't helped. Any suggestions? thanks, Glen

2 1