- stunnel-users - stunnel.org

enforcing minimum cipher set available
by auto403973＠hushmail.com 29 Dec '04

29 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is there a way (perhaps using extended 'options' section?), to enforce a minimum cipher strength / type for the connecting client? a solution would be to use apache 2's sslproxy to stunnel (yikes), but stunnel rocks :) apache / mod_ssl - from httpd.conf # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:- SSLv2:+EXP:+eNULL -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkHSUs4ACgkQdgNHoxEs/oi+2ACfYPDjijulcO0luIPfV2oYZ4aLWdAA niumLVXQRaEEK12TO5EF12e9ay/b =aNe8 -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get secure FREE email: http://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger http://www.hushmail.com/services-messenger?l=434 Promote security and make money with the Hushmail Affiliate Program: http://www.hushmail.com/about-affiliate?l=427

2 1

using stunnel for smb networking
by David Bear 28 Dec '04

28 Dec '04

out of curiousity, has anyone been able to use stunnel as a cheap vpn for smb/cifs windows networks? We have a stupid firewall policy that blocks ALL port 139 traffic. Yes, thats good most of the time since microsoft rpc's are notoriously insecure. It does cause a problem when we have other units at other universities with different firewall policies however, so I was hoping to go around the different bureacracies and tunnel it myself. just curious. -- David Bear phone: 480-965-8257 fax: 480-965-9189 College of Public Programs/ASU Wilson Hall 232 Tempe, AZ 85287-0803 "Beware the IP portfolio, everyone will be suspect of trespassing"

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: [stunnel-announce] Problem with stunnel 4.06 on FreeBSD andpossibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Jay W. Reffner wrote: > Could you explain the problem on FreeBSD? > Do you think the problems exists in OpenBSD as well? poll() call uses a negative parameter value to indicate an infinite timeout. On some systems (like Linux) any negative value is accepted, while some other systems (like FreeBSD or HP-UX) require -1 here. On affected systems stunnel starts an infinite loop and does not accept any connections. I'm not sure if OpenBSD is affected. Best regards, Mike

1 0

Re: Gmail / Eudora / SpamPal and Stunnel
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

(i copy message i have send via google groups) > I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 maybe try latest build ? > Gmail REQUIRES SSL > A connection to my university email will not SEND over IMAP as you, i cannot send to gmail servers he stops now at (i have used "protocol = smtp" in options) 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:05 LOG7[16629555:16525099]: <- 220 2.0.0 Ready to start TLS. 2004.12.23 23:24:05 LOG5[16629555:16525099]: Protocol negotiation succeded 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): before/connect initialization 2004.12.23 23:24:05 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client hello A 2004.12.23 23:24:05 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server hello A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server certificate A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read server done A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write client key exchange A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write change cipher spec A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 write finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 flush data 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: FD=124, DIR=read 2004.12.23 23:24:06 LOG7[16629555:16525099]: waitforsocket: ok 2004.12.23 23:24:06 LOG7[16629555:16525099]: SSL state (connect): SSLv3 read finished A 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 items in the session cache 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects (SSL_connect()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 1 client connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 client renegotiatations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects (SSL_accept()) 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server connects that finished 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 server renegotiatiations requested 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache hits 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache misses 2004.12.23 23:24:06 LOG7[16629555:16525099]: 0 session cache timeouts 2004.12.23 23:24:06 LOG6[16629555:16525099]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 else for mail.vfemail.net:465 /mail.gmx.net:465 without "protocol = smtp" it works well... > Yes I know Spampal and Gmail is "belt and braces" but I have a challenge > here!!!! > Justified "give up you can't" would be equally appreciated so i do... only for gmail...

1 0

ERROR: stunnel-4.06.exe file is linked to missing export ...
by Sebastien WILLEMIJNS 28 Dec '04

28 Dec '04

> When I try to start and test stunnel-4.06 on Windows ME, I get the > following error message: > The STUNNEL-4.06.EXE file is linked to missing export > WS2_32.DLL:freeaddinfo Same thing on Win98SE :X

1 0

stunnel 4.06 problems with service on XP
by Mat Leinmueller 28 Dec '04

28 Dec '04

Hi, I tried to upgrade an existing 4.04 stunnel service to 4.06 (uninstalled service, reinstalled with new version). The service gets registered correctly, when I try to start it, however, it seems not to find the stunnel.conf file. After downgrading to 4.04 everything works again. Any suggestions? Mat

2 1

Error when executing stunnel 4.06 Windows binaries as service
by Liron Newman 28 Dec '04

28 Dec '04

Hello, I'm trying to run the offical stunnel 4.06 Win32 binaries from stunnel.org as a service, but I get the following error: "The procedure entry point freeaddrinfo could not be located in the dynamic link library WS2_32.DLL" I looked it up a bit and it seems to have something to do with IPv6, but I don't use it.. stunnel 4.05 works fine as a service, and worked without a problem for months now. I'm using Win2k SP4 fully patched. Help? :)

2 1

Problem with stunnel 4.06 on FreeBSD and possibly other systems
by Michal Trojnara 28 Dec '04

28 Dec '04

Dear Users, Frank de Bot has found a bug in stunnel 4.06. I've attached the patch stunnel needs to work on FreeBSD (and possibly other) systems. It's not needed on Linux and WIN32 platforms. Best regards, Mike

2 1

ERROR: stunnel-4.06.exe file is linked to missing export ...
by Mike_Stunnel 26 Dec '04

26 Dec '04

When I try to start and test stunnel-4.06 on Windows ME, I get the following error message: The STUNNEL-4.06.EXE file is linked to missing export WS2_32.DLL:freeaddinfo Stunnel-4.05 runs fine and I have OpenSSL 0.9.7e How do I resolve this? Thanks, mz

1 0

Stunnel 4.06 released
by Michal Trojnara 25 Dec '04

25 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Here is the ChangeLog entry: Version 4.06, 2004.12.26, urgency: LOW: * New feature sponsored by SURFnet http://www.surfnet.nl/ - IPv6 support (to be enabled with ./configure --enable-ipv6). * New features - poll() support - no more FD_SETSIZE limit! - Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. This feature is not compatible with delayed resolver. - New 'compression' option to enable compression. To use zlib algorithm you have to enable it when building OpenSSL library. - New 'engine' option to select a hardware engine. - New 'TIMEOUTconnect' option with 10 seconds default added. - stunnel3 perl script to emulate version 3.x command line options. - French manual updated by Bernard Choppy <choppy AT free POINT fr>. - A watchdog to detect transfer() infinite loops added. - Configuration file comment character changed from '#' to ';'. '#' will still be recognized to keep compatibility. - MT-safe getaddrinfo() and getnameinfo() are used where available to get better performance on resolver calls. - Automake upgraded from 1.4-p4 to 1.7.9. * Bugfixes - log() changed to s_log() to avoid conflicts on some systems. - Common CRIT_INET critical section introduced instead of separate CRIT_NTOA and CRIT_RESOLVER to avoid potential problems with libwrap (TCP Wrappers) library. - CreateThread() finally replaced with _beginthread() on Win32. - make install creates $(localstatedir)/stunnel. $(localstatedir)/stunnel/dev/zero is also created on Solaris. - Race condition with client session cache fixed. - Other minor bugfixes. * Release notes - Win32 port requires Winsock2 to work. Some Win95 systems may need a free update from Microsoft. http://www.microsoft.com/windows95/downloads/ - Default is *not* to use IPv6 '::' for accept and '::1' for connect. For example to accept pop3s on IPv6 you could use: 'accept = :::995'. I hope the new syntax is clear enough. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBzf1b/NU+nXTHMtERAtUVAKD+41kLTFS/qrOleskfH1MZEkYr2ACfcJPZ 4QQk085XimnyplqENZaT7nk= =zIM2 -----END PGP SIGNATURE-----

1 0

Faulting application stunnel-4.05.exe
by Paulo Cesar Soares da Silva 25 Dec '04

25 Dec '04

stunnel-4.05.exe executed as a service presents the following problems: Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8. Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libeay32.dll, version 0.0.0.0, fault address 0x000564ec. The application, C:\Program Files\Crivo\tn3270\stunnel-4.05.exe, generated an application error The error occurred on 11/10/2004 @ 15:37:13.875 The exception generated was c0000005 at address 6B086CD8 (libssl32!SSL_set_session) Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x000086f7. Environment: Hardware IBM 86496BX Dual processor 3 GHz Software OS Name Microsoft(R) Windows(R) Server 2003, Standard Edition , Version 5.2.3790 Build 3790 The following files are in same folder (..\Program Files\Teste\Stunnel) stunnel-4.05.exe, 4.05 libeay32.dll, openssl-0.9.7d-zlib libssl32.dll, openssl-0.9.7d-zlib Comntents of stunnel.conf: client = yes verify = 0 service = stunnel 4.05 options = DONT_INSERT_EMPTY_FRAGMENTS [data] accept = localhost:3500 connect = www.teste.com.br:443 delay = yes I would appreciate if anyone can help me on this? many thanks in advance! Paulo Cesar Soares da Silva (11) 3231-5396 pcesar(a)crivo.com.br --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004 --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.799 / Virus Database: 543 - Release Date: 19/11/2004

2 1

Gmail / Eudora / SpamPal and Stunnel
by John Bullas 22 Dec '04

22 Dec '04

Good Morning I hope there is someone on this group who can assist? I am running Eudora 6.2.0.14, Stunnel-4.04, SpamPal 1,583 win 2k on D drive / Stunnel on e (partitions not physical) startup line E:\stunnel\stunnel-4.04.exe Stunnel log after running it (systray icon appears to suggest it is started and Services app allowed me to start it) 2004.12.22 08:15:32 LOG5[3216:208]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7c 30 Sep 2003 2004.12.22 08:15:32 LOG7[3216:1504]: Snagged 64 random bytes from C:/.rnd 2004.12.22 08:15:32 LOG7[3216:1504]: Wrote 1024 new random bytes to C:/.rnd 2004.12.22 08:15:32 LOG7[3216:1504]: RAND_status claims sufficient entropy for the PRNG 2004.12.22 08:15:32 LOG6[3216:1504]: PRNG seeded successfully 2004.12.22 08:15:32 LOG5[3216:1504]: WIN32 platform: 30000 clients allowed 2004.12.22 08:15:32 LOG7[3216:1504]: FD 324 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: pop bound to 127.0.0.1:1109 2004.12.22 08:15:32 LOG7[3216:1504]: FD 332 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: imap bound to 127.0.0.1:1439 2004.12.22 08:15:32 LOG7[3216:1504]: FD 340 in non-blocking mode 2004.12.22 08:15:32 LOG7[3216:1504]: SO_REUSEADDR option set on accept socket 2004.12.22 08:15:32 LOG7[3216:1504]: smtp bound to 127.0.0.1:259 Eudora settings: username: [email protected]@127.0.0.1:1109 smtp server:127.0.0.1 incoming server as POP and local ohst or 127.0.0.1 see below I can RECEIVE Gmail ok but SENDING prompts a "Could not connect to "127.0.0.1" Cause: connection refused (10061) ditto if "localhost" is used as the pop server in steadof 127.0.0.1 I have Hotmail Popper on 127.0.0.2 for hotmail and Spampal/Eudora is fine with that Hotmail Popper? A method to send/receive Hotmail via POP http://www.boolean.ca/hotpop/ Spampal? http://www.spampal.org a free spam tagging proxy(?) I am now in the realms of "playing about" to try and fix this outgoing mail issue HOWEVER I am sure someone in this forum has Gmail happily sending and receiving!!!! Gmail REQUIRES SSL A connection to my university email will not SEND over IMAP and needs to go out via SMTP as it requires a verified internal IP address to work (relay denied) I am uncertain of how the SSL settings in Eudora need to be set to allow Gmail to both send/receive using Required Alternate Post as given in the online help for Gmail via spampal and Stunnel http://gmail.google.com/support/bin/answer.py?answer=13279&query=eudora&top… ( aka: http://tinyurl.com/5vp6u ) Your learned wisdom would be welcome!!!! Regards John "Fatbloke" Bullas Southampton UK Yes I know Spampal and Gmail is "belt and braces" but I have a challenge here!!!! Justified "give up you can't" would be equally appreciated ** Eudora Mail 6.2 / McAfee Virus Scan 4.5.1 / Sp*mPal **

1 0

Fwd: [stunnel-users] stunnel 'options' section of config file
by Justin Miller 21 Dec '04

21 Dec '04

I understand the security concerns... I was just trying different protocols because I was receiving weird error messages with some https proxies (using the mathias wald patch) about wrong version numbers, etc. Googling it seemed to indicate that enabling/disabling ssl2/ssl3/tls1 could do the trick. However, I can't even get 'openssl s_client...' to yield a successful connection with some of these proxies. Can stunnel handle incoming http or socks proxy requests/connections? If not, will you ever support that? For instance I want stunnel listening on a local port 8080 and connect to a remote https proxy, and I set the HTTP proxy server in gaim to localhost:8080. -Justin On Tue, 21 Dec 2004 15:20:19 +0100, Michal Trojnara <Michal.Trojnara(a)mobi-com.net> wrote: > Justin Miller wrote: > > So all looks well ang good... But then when it sends the client hello > > message, one would expect an ssl2 message, but we get the following > > Stunnel is not supposed to act as SSLv2 client. It uses > SSLv3_client_method() in src/ssl.c file. If you really need SSLv2 - change > it to SSLv2_client_method() and recompile stunnel. It's not recommended for > security, anyway. > > See SSL_CTX_new(3) manual for details. > > Best regards, > Mike > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 2

stunnel 'options' section of config file
by Justin Miller 21 Dec '04

21 Dec '04

Is it just me, or does stunnel not seem to obey the ssl 'options' setting in the config file? I have the lines: options = TLS_ROLLBACK_BUG options = NO_TLSv1 options = NO_SSLv3 And when I start stunnel, the output is: 2004.12.20 07:47:46 LOG7[9981:1024]: Configuration SSL options: 0x06800000 2004.12.20 07:47:46 LOG7[9981:1024]: SSL options set: 0x06800000 So all looks well ang good... But then when it sends the client hello message, one would expect an ssl2 message, but we get the following output: 2004.12.20 07:47:51 LOG7[9984:1026]: SSL state (connect): SSLv3 write client hello A 2004.12.20 07:47:51 LOG7[9984:1026]: waitforsocket: FD=10, DIR=read 2004.12.20 07:47:51 LOG7[9984:1026]: waitforsocket: ok 2004.12.20 07:47:51 LOG7[9984:1026]: SSL alert (write): fatal: handshake failure 2004.12.20 07:47:51 LOG3[9984:1026]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number That first line seems to indicate that it's still sending a v3 message. Is this actually what's happening?

2 1

Re: [stunnel-users] UDP applications
by Colin McKinnon 21 Dec '04

21 Dec '04

On Tuesday 21 December 2004 03:58, you wrote: > > This encapsulation of udp packets was what i was referring to... Could > you plz give me some pointers where this is "well" documented. > Google suggested: http://www.stunnel.org/examples/pppvpn.html http://www.buildinglinuxvpns.net/sourcecode/r/4/vpn-server.html http://mia.ece.uic.edu/~papers/bin/ppp_over_ssl_vpn_client http://irb.cs.tu-berlin.de/dienste/dialup/inhouse/irbvpnclient (although note that a cursory glance trhough suggests sme of these use stunnel v3 config syntax) C.

1 0

stunnel 4.06 and compression
by saruman 20 Dec '04

20 Dec '04

Hello. Is there any way to get the beta version of stunnel 4.06 (I've seen in this list that it must support compression)? Or if I can't get new version - can I somehow enable compression in stunnel 4.05? Oleg Ivanov

1 0

Problem with huge stunnel.conf
by CIM Massy 20 Dec '04

20 Dec '04

Hi everyone ! I have 900 (W2K) machines that I have to securely log onto. I chose to use both of Ultr@VNC and RealVNC 4.0 (running on ports 5900 & 5901). And I chose to use STunnel 4.05 on W2K to secure the sockets. On my admin PC, Stunnel.conf looks like /*******************************/ #cert stuff [ultravnc0101] accept = 127.0.1.1:5900 connect = PC0101:5700 [realvnc0101] accept = 127.0.1.1:5901 connect = PC0101:5701 ... [ultravnc1000] accept = 127.0.10.0:5900 connect = PC1000:5700 [realvnc1000] accept = 127.0.10.0:5901 connect = PC1000:5701 /*******************************/ And it does only work for the first 31 pairs of "services". (No Authentification issues.) When I move the "PC0101" services to the end of the file it will not work anymore, whereas it does when it's first in the .conf file. I guess having 1800 services is not necessarily the way Stunnel is meant to work... Is it a known issue ? I haven't been able to find any infos on it in newsgroups or with Google. It does not seem to be a W2K problem since it works with the 64 first services. If anyone knows a workaround... Thanks for your help, Reagrds Philippe HAMEAU

3 3

UDP applications
by Paul 20 Dec '04

20 Dec '04

Hi all, Is there any roadmap for Stunnel to support UDP applications? Cant a simple UDP forwarder (with proper buffering to ensure a tcp-like stream of data) do the job? May be this topic is discussed and brainstormed before. I couldnot find any relevant details about this in the archives. Thanks and Regards, Paul

2 1

Need help: verification of client and server certificates
by Mike_Stunnel 20 Dec '04

20 Dec '04

For my Stunnel server, I'm using Windows ME, OpenSSL 0.9.7e and Stunnel 4.05. I've create my own Certificate Authority on my server and created and signed a server and multiple client certificates for Stunnel. I plan to use Stunnel to secure my VNC connections to my PC - to encrypt the traffic and to validate the clients. On the server side: ------------------- I want to limit connections to my Stunnel server to only those Stunnel clients that present a client certificate that I already have a copy of on my server. And I want Stunnel server to only recognize my own Certificate Authority as a valid CA for the clients' certificates. Is this possible? What options do I need to specify in the Stunnel server configuration file to make this work? The documentation is confusing to me - for example, do I use CAfile or CApath to point Stunnel to the the CA certificate? Will Stunnel recognize other CAs as trusted, if their certificates have been loaded by other programs like a browsers or mail reader? Etcetera .. On the client side: ------------------- As with the server, I want my Stunnel client to only recognize my own CA as trusted. And I want it to validate the server certificate as thoroughly as possible. Is that verify level 3? I need the CA certificate on my client, but do I use CAfile or CAcert in the config file to point to it? Do I need a copy of the server certificate on my client so that the client can verify the server's certificate? I'm so confused! I've read the FAQ and Related links on stunnel.org and also the past 4 months' mailing list digests but I'm still not clear on the certificate verification process. or all the options in the configuration file.

1 0

Socks Support
by Paul 15 Dec '04

15 Dec '04

I have been working/using stunnel for quite sometime... I am using it along with SOcks. So was wondering is there anyone who is already working on providing socks (v4 or v5) support to existing stunnel? Also is there any1 else who is also requires socks functionality in stunnel? Thanks and Regards, Paul.

2 1

Stunnel Keeps Closing Connections with an Error
by Jerry Baker 09 Dec '04

09 Dec '04

I am using Stunnel 4.05 on Windows 98/XP to connect VNC clients to a Windows XP server. I am continually getting disconnected by Stunnel with the following error: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac I have tried using the OpenSSL 0.9.7d binaries from stunnel.org AND compiling OpenSSL 0.9.7e myself. Either way, the same result. Thanks in advance.

1 0

SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate
by Ron Kindermann 09 Dec '04

09 Dec '04

Hello, I use stunnel on WinXP to connect to my ISP's pops server and get the following error message in my log: 2004.12.09 12:47:09 LOG5[4888:6096]: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7e 25 Oct 2004 2004.12.09 12:47:11 LOG5[4888:4612]: WIN32 platform: 30000 clients allowed 2004.12.09 12:47:46 LOG5[4888:5432]: pops.xs4all.nl:995 connected from 127.0.0.1:61950 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG5[4888:5432]: VERIFY IGNORE: depth=0, /C=NL/ST=Noord Holland/L=Diemen/O=XS4ALL Internet B.V./CN=pops.xs4all.nl 2004.12.09 12:47:46 LOG3[4888:5432]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate This is my config: CAfile = xxxxx cert = xxxxx CRLpath = xxxxx client = yes # debug = 4 key = xxxxx options = DONT_INSERT_EMPTY_FRAGMENTS output = stunnel.log RNDbytes = 64 RNDfile = .rnd RNDoverwrite = yes service = Stunnel client session = 300 taskbar = no verify = 0 [pops.xs4all.nl:995] accept = 127.0.0.1:5000 connect = pops.xs4all.nl:995 delay = yes [pop.gmail.com:995] accept = 127.0.0.1:5003 connect = pop.gmail.com:995 delay = yes The "xxxxx" are good filepaths because I can connect to pop.gmail.com:465 just fine. Anyone got a clue where to look? Thanks, Ron

1 1

cannot connect to gmail (STARTTLS trouble ?)
by Sebastien WILLEMIJNS 05 Dec '04

05 Dec '04

hello, i'm trying to test gmail SMTP server with postie (a commandline poster) and stunnel.... POP access to port 995 is OK SMTP access with gmail is bad (authentification failed) SMTP access with gmx.net and vfemail.net is OK In eudora software , it speak about 3 methods to use SSL, how to try in stunnel these method ? ********************* STUNNEL.CNF client = yes [X]>> stunnel.cnf accept = 1664 connect = smtp.gmail.com:465 ******************** WIN32 COMMANDLINE IS "stunne~1.exe stunnel.cnf" ********************* EUDORA DOC The Generic Properties tab is used to set the SSL options for sending mail (SMTP). The available options are: * Never -- tells Eudora not to use SSL * If Available, STARTTLS -- tells Eudora to use SSL if it is available * Required, Alternate Port -- tells Eudora that the use of SSL is required, on the alternate port (more on this in a minute) * Required, STARTTLS -- tells Eudora that the use of SSL is required *********************** MY GMAIL LOG here's the log i have +OK Gpop ready. USER willemijns(a)gmail.com +OK send PASS PASS xxxxxxxx +OK Welcome. STAT +OK 0 0 There are 0 messages waiting (0 bytes) QUIT +OK Farewell. %%%%%%%%%%% 220 smtp.gmail.com ESMTP 79sm7704rna EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES AUTH PLAIN 334 = AHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX2 235 2.7.0 Accepted EHLO 80-125-222-144.dti.cegetel.net 250-smtp.gmail.com at your service 250-SIZE 20971520 250-8BITMIME 250-AUTH PLAIN LOGIN 250 ENHANCEDSTATUSCODES Connected to 'smtp.gmail.com:465' MAIL FROM:<willemijns(a)gmail.com> 530 5.7.0 Authentication Required Could not send: error= -1 Status: 530 5.7.0 Authentication Required **********i've noticied when it works well (with GMX.NET) i can see "250 STARTTLS" as: Query for (NS) 'runbox.com' [127.0.0.1] MX/A server (0) = '' 220 {mp009} GMX Mailservices ESMTP EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS AUTH PLAIN 334 Go on AHXXXXXXXXXXXXXXXXXXXXXXXXXXX== 235 2.7.0 {mp009} Go ahead EHLO localhost 250-{mp009} GMX Mailservices 250-8BITMIME 250-ENHANCEDSTATUSCODES 250-AUTH=LOGIN CRAM-MD5 PLAIN 250-AUTH CRAM-MD5 LOGIN PLAIN 250 STARTTLS Connected to '127.0.0.1:1664' MAIL FROM:<willemijns(a)gmx.net> 250 2.1.0 {mp009} ok RCPT TO:<vivil(a)runbox.com> 250 2.1.5 {mp009} ok DATA 354 {mp009} Go ahead To: vivil(a)runbox.com (...) thanks of your help :-) ----- End Forwarded Message ----- ----- End Forwarded Message -----

1 0

Using Stunnel for ICMP traffic
by Montoya_Paul＠emc.com 03 Dec '04

03 Dec '04

Dear group, Would anyone know how I can go about setting up Stunnel to tunnel all ICMP traffic between two systems? I'm just looking for the basic steps required in the process. Any useful documentation links would be great. Thank you much in advance. Regards, > Paul Montoya > Associate Implementation Specialist > Scottsdale, AZ > EMC² > where information lives > http://www.emc.com <http://www.emc.com>

2 1

same questions about problems with stunnel-4.05 and the old 3.2x command line
by 86493293＠gmx.net 02 Dec '04

02 Dec '04

Hi Michal, i'm using stunnel since version 3.2x and now i'm trying to switch to version 4.05. but there still some problems left so i searched the "net" and found only one article about this problems (http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000013.html) but this solution seems not to work for me or i'm a little bit to stupid to understand it. i used 3.2x with the following command line: $ stunnel -P ~/ -v2 -A ./publickey.pem -p privatekey.pem -r target_host.net:666 -c -d 127.0.0.1:7777 Then i tried to write me my own config-file for stunnel-4.05. $ cat /etc/stunnel/stunnel.conf # pid is created in an jail pid = /home/user/.stunnel/stunnel.pid # Some debugging stuff debug = 7 output = /home/user/.stunnel/stunnel.log # use it for client mode client = yes foreground = yes # Authentification verify = 3 cert = /home/user/privatekey.pem CAfile = /home/user/publickey.pem # Service-Level Configuration [application] accept = 127.0.0.1:666 connect = targethost.net:7777 But this one does not work. The stunnel.log told me this: $ cat /home/user/stunnel.log 2004.12.01 22:20:12 LOG5[15233:1006686208]: stunnel 4.05 on i386-unknown-openbsd3.6 PTHREAD+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 2004.12.01 22:20:12 LOG7[15233:1006686208]: Snagged 64 random bytes from /dev/arandom 2004.12.01 22:20:12 LOG7[15233:1006686208]: RAND_status claims sufficient entropy for the PRNG 2004.12.01 22:20:12 LOG6[15233:1006686208]: PRNG seeded successfully 2004.12.01 22:20:12 LOG7[15233:1006686208]: Certificate: /home/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Key file: /home/user/privatekey.pem 2004.12.01 22:20:12 LOG7[15233:1006686208]: Loaded verify certificates from /home/user/publickey.pem 2004.12.01 22:20:12 LOG5[15233:1006686208]: FD_SETSIZE=1024, file ulimit=128 -> 61 clients allowed 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 7 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: SO_REUSEADDR option set on accept socket 2004.12.01 22:20:12 LOG7[15233:1006686208]: application bound to 127.0.0.1:666 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 8 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: FD 9 in non-blocking mode 2004.12.01 22:20:12 LOG7[15233:1006686208]: Created pid file /var/run/stunnel.pid It looks for me normal but i can not connect to this local port and i can not seen the "stunnel" as an process in my "ps -al |grep stunnel". And there is no error message or something like that. But when i try to connect to this local adress 127.0.0.1:666 i get always an "lost connection". Please tell me if my config-file is right?! So i know that the mistake must be at the "application" and not in my stunnel.conf. Thx for your help! With Regards Mario -- GMX ProMail mit bestem Virenschutz http://www.gmx.net/de/go/mail +++ Empfehlung der Redaktion +++ Internet Professionell 10/04 +++

1 0

Q: stunnel checking of certs?
by Heiko Nardmann 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi together! Two questions: 1) does stunnel read the cert files/directories only once at startup or every time it has to check a certificate? 2) does stunnel support CRLs? e.g. getting the CRL via LDAP? - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBrIIEpm53PRScYygRAtQ6AKC9JSTTK7mAL+51JSWkTI5U52HtJQCeMvCR gEiUxqi43/pFMD/3dR6hVeE= =MFLP -----END PGP SIGNATURE-----

2 2

Compiling on Solaris
by Didier Gehéniau 01 Dec '04

01 Dec '04

Hi all, The problem i have, i found a lot on the internet. Unfortunatly non of the solutions (if there was one) did nog help. When doing ./configure i get the folowing output: [snip] checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets $(MAKE)... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking build system type... sparc-sun-solaris2.8 checking host system type... sparc-sun-solaris2.8 checking for gcc... gcc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes checking for ld used by GCC... /usr/ccs/bin/ld checking if the linker (/usr/ccs/bin/ld) is GNU ld... no checking for /usr/ccs/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/local/bin/nm -B checking for a sed that does not truncate output... /usr/bin/sed checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking command to parse /usr/local/bin/nm -B output... ok checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/ccs/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... solaris2.8 ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr/local/ssl checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... yes checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... no checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for setsid... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 See `config.log' for more details. [/snip] I installed gstdint.h and linked stdint.h to it. (should be a solution for some persons) gcc -v gives: [snip] Reading specs from /usr/local/lib/gcc/sparc-sun-solaris2.8/3.4.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.4.2 [/snip] Anyone an Idee? Regards, Didier

2 1

Re: [stunnel-users] How use certificates with stunnel -- Newbie question
by mtrojnar＠mirt 28 Nov '04

28 Nov '04

Shatadal wrote: I guess there's a client=yes here. > # IMAP service, listens on localhost:1200 > [myisp-imaps] > accept=localhost:1200 > connect=myisp.com:993 Ok. IMAPS port is 993. > # SMTP service, listens on localhost:260 > [myisp-smtps] > accept=localhost:260 > connect=myisp.com:25 You either need to switch from SMTP to SSMTP: [myisp-ssmtp] accept=localhost:260 connect=myisp.com:465 or enable SMTP SSL protocol negotiation: [myisp-smtp-ssl] accept=localhost:260 connect=myisp.com:25 protocol=smtp (whatever is supported by your ISP) Best regards, Mike

2 3

How use certificates with stunnel -- Newbie question
by Shatadal 25 Nov '04

25 Nov '04

Hi, I am a new user of stunnel and I am using it to connect to some SSL enabled e-mail accounts. Instead of directly connecting to the mail server I am connecting to it via stunnel so that my e-mail scanner scan the messages before sending it to the mail server (it does not natively support SSL connections) My setup: OS: Win XP Home edition. All updates are installed except for service pack 2. E-mail client: Mozilla Thunderbird 0.9 E-mail scanner : Alwil Avast 4.5 I have an e-mail account at myisp.com. To connect to myisp I need to enable SSL. On connecting via SSL I get a certificate which I can choose to accept permanently, temporarily for the current session or reject it. Alwil Avast mail scanner does not support scanning of e-mail sent and received over SSL. So to enable it to scan such e-mail, my client connects to localhost where stunnel is listening and stunnel forwards the connection to my isp. This is my stunnel.conf file # IMAP service, listens on localhost:1200 [myisp-imaps] accept=localhost:1200 connect=myisp.com:993 # SMTP service, listens on localhost:260 [myisp-smtps] accept=localhost:260 connect=myisp.com:25 Unfortunately while the IMAP connection works perfectly the SMTP does not. Thunderbird keeps sending the message until I cancel it. This is the log file 2004.11.25 03:10:03 LOG5[2508:3848]: myisp-smtps connected from 127.0.0.1:2751 2004.11.25 03:10:08 LOG3[2508:3848]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 03:11:03 LOG5[2508:192]: myisp-smtps connected from 127.0.0.1:2755 2004.11.25 03:11:08 LOG3[2508:192]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 13:36:40 LOG5[2508:2112]: myisp-smtps connected from 127.0.0.1:4818 2004.11.25 13:36:45 LOG3[2508:2112]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2004.11.25 14:01:44 LOG5[2508:3208]: myisp-smtps connected from 127.0.0.1:1188 2004.11.25 14:01:50 LOG3[2508:3208]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I am guessing the problem is something to do with the handling of the certificate I get when I use my client to connect directly to the SMTP server via SSL. Can someone explain to me how to make stunnel accept the certificate and continue the SSL transaction? I tried to read through the faq for certificates but I couldn't understand how it was to be done. Thanks, Shatadal. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0448-0, 11/23/2004 Tested on: 11/25/2004 3:46:33 PM avast! - copyright (c) 2000-2004 ALWIL Software. http://www.avast.com

1 0

Sercure POP from Outlook Express using Stunnel on a linux server to talk to an exchance server.
by CONN, Aurelia 25 Nov '04

25 Nov '04

Hi I'm just about to investigate setting up a secure pop connection to an exchange server - can anyone point to helpfull resources or say if it can/cannot be done. Using Outlook (Express) as mail client SSL and Stunnel installed on Redhat 9 Mailserver is Exchange 5.5 on Windows NT 4.0 For example, will I have to configure/install on all three boxes? All my initial testing will be done internally so no firewall issues at this stage. Thanks in advance. Oz. ________________________________________________________________________ airwide solutions has changed its email address format to firstname.lastname(a)airwidesolutions.com. Any slb.com email addresses are no longer valid. If you experience difficulty contacting our staff, please email info(a)airwidesolutions.com. ________________________________________________________________________

1 0

SSL Engine patch on Windows?
by Kartik Subbarao 22 Nov '04

22 Nov '04

I'm trying to use stunnel with the SSL Hardware Engine patch (posted by Neil Dunbar to this mailing list in March) on Windows. I apply the patch to the 4.05 codebase and build stunnel with MinGW. I'm able to use stunnel normally without exercising any hardware engine functionality. This tells me that the basics are working. I then run stunnel with the config file containing the following kinds of hardware engine parameters: SSLEngine=c:\windows\system32\engine_pkcs11.dll SSLEngineOpt=MODULE_PATH=c:\windows\system32\acpkcs201.dll But when I run stunnel, I get errors with dynamic library loading like: error stack: 260B6084 : error:260B6084:engine routines:DYNAMIC_LOAD:dso not found And similar errors like that. This gives me the impression that I haven't linked stunnel properly on windows to be able to use OpenSSL dynamic libraries. Or perhaps some other explanation that I don't understand :-) Is it possible to compile stunnel on Windows (either with MinGW or with Visual C++) to be able to use the hardware engine patch? Any pointers/assistance would be greatly appreciated. Thanks, -Kartik

1 3

Faulting application stunnel-4.05.exe
by Paulo Cesar Soares da Silva 18 Nov '04

18 Nov '04

stunnel-4.05.exe executed as a service presents the following problems: Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8. Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module libeay32.dll, version 0.0.0.0, fault address 0x000564ec. The application, C:\Program Files\Crivo\tn3270\stunnel-4.05.exe, generated an application error The error occurred on 11/10/2004 @ 15:37:13.875 The exception generated was c0000005 at address 6B086CD8 (libssl32!SSL_set_session) Faulting application stunnel-4.05.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x000086f7. Environment: Hardware IBM 86496BX Dual processor 3 GHz Software OS Name Microsoft(R) Windows(R) Server 2003, Standard Edition , Version 5.2.3790 Build 3790 The following files are in same folder (..\Program Files\Teste\Stunnel) stunnel-4.05.exe, 4.05 libeay32.dll, openssl-0.9.7d-zlib libssl32.dll, openssl-0.9.7d-zlib Comntents of stunnel.conf: client = yes verify = 0 service = stunnel 4.05 options = DONT_INSERT_EMPTY_FRAGMENTS [data] accept = localhost:3500 connect = www.teste.com.br:443 delay = yes I would appreciate if anyone can help me on this? many thanks in advance! Paulo Cesar Soares da Silva (11) 3231-5396 pcesar(a)crivo.com.br --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.794 / Virus Database: 538 - Release Date: 10/11/2004

1 0

List of Distinguished names in Certificate Request message
by Diarmuid O'Neill 17 Nov '04

17 Nov '04

Hi, At the moment, stunnel's client certificate verification implementation does not include any Distinguished Names (of the trusted CA certificates configured) in the Request Certificate message. Strictly speaking this violates RFC2246 (see below, apologies for formatting), but to date I've only seen one client that has a problem with it. Explorer deals with this by displaying all available user certificates. If the Distinguished Names are included in the cert req it only displays client certs signed by the appropriate CAs. The patch below does the necessary openssl bits and pieces to make up the lists of DNs so they're sent with the certificate requests. This has been tested under linux only. 7.4.4. Certificate request When this message will be sent: A non-anonymous server can optionally request a certificate from the client, if appropriate for the selected cipher suite. This message, if sent, will immediately follow the Server Key Exchange message (if it is sent; otherwise, the Server Certificate message). Structure of this message: enum { rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4), (255) } ClientCertificateType; opaque DistinguishedName<1..2^16-1>; struct { ClientCertificateType certificate_types<1..2^8-1>; DistinguishedName certificate_authorities<3..2^16-1>; } CertificateRequest; certificate_types This field is a list of the types of certificates requested, sorted in order of the server's preference. certificate_authorities A list of the distinguished names of acceptable certificate authorities. These distinguished names may specify a desired distinguished name for a root CA or for a subordinate CA; thus, this message can be used both to describe known roots and a desired authorization space. Note: DistinguishedName is derived from [X509]. Note: It is a fatal handshake_failure alert for an anonymous server to request client identification. Thanks, Diarmuid. <<stunnel-4.05_ca_list.patch>> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

2 1

How to run stunnel in client and server mode on the same machine?
by Àëåêñåé Êàìåíåâ Íèêî ëàåâè÷ 17 Nov '04

17 Nov '04

I have a task: ecript traffic for my db server(m1) and www/smtp server(m2) I install stunnel on both machines (m1 and m2) then wrote config files m1: ... client = no ... [mssql] accept=1434 connect=1433 m2: ... client=no ... [smtp] accept=465 connect=25 and m3: some client machine ... client=yes ... [mssql] accept=1433 connect=m1:1434 [smtp] accept=25 connect=m2:465 when I connect to db m3->m1 - ok when I send mail m3->m2 - ok but when I connect to db m2->m1 - failed how configure m2 stunnel to let him work in client and server mode ?

1 0

Log file rotation
by Jalasutram, Srivatsava 16 Nov '04

16 Nov '04

Is there a way in the latest version of stunnel for rotating the log files? Thanks, Sri

1 0

always open VPN channel
by Andrisi 15 Nov '04

15 Nov '04

I'd like to access a PC behind a firewall with VNC. I initiate a link from the PC behind the firewall. This tunnel should always be enabled. Then I use VNCClient on my home PC and connect to localhost:6000 which is linked to the firewalled PC-s VNC server port. Is it possible and if so, how? The server and client roles are a bit mixed up here....

2 1

inetd Solaris Stunnel 4.05
by Kenneth Simpson 12 Nov '04

12 Nov '04

Hi - I'm trying to get stunnel 4.05 to work under inetd on a Solaris x86 platform (and Solaris 8 on a SPARC platform.) The IMAP and POP daemons are verison 2004 from UW (or UW 2001 on a SPARC.) The IMAP client is Thunderbird 0.8. I can connect to IMAP inetd service on port 143 with Thunderbird. When I attempt to connect to IMAP on port 993, I'm presented a self signed certificate, I click OK to accept it, then Thunderbird just hangs. There's no indication in IMAP log file that I've connected - and there doesn't appear to be any indication in the stunnel log file that I've been connected to the IMAP server either. stunnel and the IMAP servers work in the standalone mode. When stunnel is running under inetd, I can telnet to port 143 and port 993. Any help would be greatly appreciated. -- Ken ; stunnel -version stunnel 4.05 on i386-pc-solaris2.8 FORK with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /usr/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/stunnel/etc/stunnel/stunnel.pem pid = /usr/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds; stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 32768 SO_SNDBUF -- -- -- 32768 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 ; inetd.conf # imap stream tcp nowait root /usr/imap/sbin/in.imapd /usr/imap/sbin/in.imapd pop3 stream tcp nowait root /usr/imap/sbin/in.pop3d /usr/imap/sbin/in.pop3d # imaps stream tcp nowait root /usr/stunnel/sbin/stunnel /usr/stunnel/sbin/stunnel /usr/stunnel/etc/stunnel.conf pop3s stream tcp nowait root /usr/stunnel/sbin/stunnel /usr/stunnel/sbin/stunnel /usr/stunnel/etc/stunnel.conf ssmtp stream tcp nowait root /usr/stunnel/sbin/stunnel /usr/stunnel/sbin/stunnel /usr/stunnel/etc/stunnel.conf ; stunnel.conf # cert = /usr/openssl/certs/stunnel.pem #chroot = /usr/stunnel/var/run/ #pid=/stunnel.pid pid= setuid = nobody setgid = nogroup debug = local2.7 output = /var/adm/log/stunnel exec = /usr/imap/sbin/in.pop3d execargs = /usr/imap/sbin/in.pop3d exec = /usr/imap/sbin/in.imapd execargs = /usr/imap/sbin/in.imapd exec = /usr/lib/sendmail execargs = /usr/lib/sendmail # # end stunnel.conf # ; log file 2004.11.11 14:52:25 LOG5[7844:0]: stunnel 4.05 on i386-pc-solaris2.8 FORK with OpenSSL 0.9.7d 17 Mar 2004 2004.11.11 14:52:25 LOG7[7844:0]: Snagged 64 random bytes from /dev/urandom 2004.11.11 14:52:25 LOG7[7844:0]: RAND_status claims sufficient entropy for the PRNG 2004.11.11 14:52:25 LOG6[7844:0]: PRNG seeded successfully 2004.11.11 14:52:25 LOG7[7844:0]: Certificate: /usr/openssl/certs/stunnel.pem 2004.11.11 14:52:25 LOG7[7844:0]: Key file: /usr/openssl/certs/stunnel.pem 2004.11.11 14:52:25 LOG7[7844:0]: stunnel started 2004.11.11 14:52:25 LOG5[7844:0]: stunnel connected from 10.0.0.15:58715 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): before/accept initialization 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 read client hello A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 write server hello A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 write certificate A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 write server done A 2004.11.11 14:52:25 LOG7[7844:0]: SSL state (accept): SSLv3 flush data 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 read client key exchange A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 read finished A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 write change cipher spec A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 write finished A 2004.11.11 14:52:26 LOG7[7844:0]: SSL state (accept): SSLv3 flush data 2004.11.11 14:52:26 LOG7[7844:0]: 1 items in the session cache 2004.11.11 14:52:26 LOG7[7844:0]: 0 client connects (SSL_connect()) 2004.11.11 14:52:26 LOG7[7844:0]: 0 client connects that finished 2004.11.11 14:52:26 LOG7[7844:0]: 0 client renegotiatations requested 2004.11.11 14:52:26 LOG7[7844:0]: 1 server connects (SSL_accept()) 2004.11.11 14:52:26 LOG7[7844:0]: 1 server connects that finished 2004.11.11 14:52:26 LOG7[7844:0]: 0 server renegotiatiations requested 2004.11.11 14:52:26 LOG7[7844:0]: 0 session cache hits 2004.11.11 14:52:26 LOG7[7844:0]: 0 session cache misses 2004.11.11 14:52:26 LOG7[7844:0]: 0 session cache timeouts 2004.11.11 14:52:26 LOG6[7844:0]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(2 56) Mac=SHA1 2004.11.11 14:52:26 LOG6[7844:0]: Local mode child started (PID=7845) 2004.11.11 14:52:26 LOG7[7844:0]: Remote FD=7 initialized ; netstat -nr | grep 143 *.143 *.* 0 0 32768 0 LISTEN ; netstat -nr | grep 993 *.993 *.* 0 0 32768 0 LISTEN

2 1

RE: [stunnel-users] SSL Engine patch on Windows?
by Diarmuid O'Neill 11 Nov '04

11 Nov '04

Sorry Kartik, I'm not familiar with Neil Dunbar's patch, and I haven't used stunnel on Windows. Not much use...am I? ;-) Diarmuid. -----Original Message----- From: Kartik Subbarao [mailto:[email protected]] Sent: 11 November 2004 00:33 To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] SSL Engine patch on Windows? Hi Diarmuid, I saw your response to my message, but I'm not sure what to make of it :-) The problem is not that I don't have the patch -- I do have the patch and have been able to apply it to the code. (BTW the patch that you posted seems to be missing the SSLEngineOpt parameter in Neil Dunbar's patch, which is required for opensc's engine_pkcs11.dll for specifying the vendor-specific PKCS11 library). My problem is that stunnel doesn't seem to be able to have OpenSSL dynamically load the engine DLL. If someone can tell me how to compile stunnel to do this on Windows, or if someone has been able to compile stunnel with the hardware engine patch successfully on Windows and is willing to share, that'd be great. Thanks, -Kartik _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

1 0

When the Port is in the URL
by George, Bijoy 10 Nov '04

10 Nov '04

Hello Everyone, I am using stunnel-3.19 and am trying to forward port 12345 on my local machine to a URL that has the following syntax: http://TestBox1:7201/sourceApp/Calculate.do?type=sf I am not sure how to set the stunnel up in this instance, but have failed with the following command: stunnel -c -d localhost:12345 -r TestBox:7201 Can someone please shed some light on my plight! Thanks!

1 0

Stunnel 4.05 engine patch
by Diarmuid O'Neill 10 Nov '04

10 Nov '04

Hi, A couple of people have asked, so here's a patch that should work with stunnel-4.05. Untar the source archive. Copy the patch to the stunnel-4.05 directory. Run patch -p1<stunnel-4.05-engine.diff. Run autoconf (Beware, i have seen make funnies which i think relate to the version of automake 1.4-p2 worked for me, 1.6 did not). Now build as normal. When running ./configure, be sure to include the --enable-ssl-engine option (see ./configure --help). To enable a particular engine, include a line in your conf file "SSLEngine = myengine". Thanks, Diarmuid. <<stunnel-4.05_engine-patch.diff>> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the postmaster at the address below. ITS-Support(a)aepsystems.com Unless the contrary is specifically indicated above nothing in this message is intended to constitute an electronic signature within the meaning of the Electronic Commerce Act 2000 or similar legislation enacted elsewhere in the world. This footnote also confirms that this email message has been swept for the presence of computer viruses. *****************************************************************************

1 0

Re: [stunnel-users] How to configure Stunnel for ICMP packets?
by Rutger Thomschitz 09 Nov '04

09 Nov '04

> > I have just started using Stunnel 4.04 with OpenSSL. This > > may seem a bit strange, but, I would like to configure > > Stunnel such that it will encrypt all my Ping packets. > > The reason in a nut shell is that I would like to use > > Ping to determine the network overhead added by SSL, as > > part of my research. How can I set up stunnel (i.e. > > stunnel.conf) to tunnel all ICMP (i.e. Ping) packets? > > If you compare ICMP ECHO REQUEST/REPLY to Stunnel in any > way then your research is useless. It's an apples to oranges > comparison. You're comparing ICMP to TCP. > > Better is to compare TCP to TCP. For example, create a client/server > protocol as follows: > > * The TCP connection is established. > * The client sends one integer that is the length of the data, > followed by the data itself. Call this a 'packet' if you will. > * The server reads the integer, followed by the rest of the data, > and sends that data back. > * The client verifies the data was received correctly, and then > procedes to send a new 'packet'. > > > Then you can implement this connection on its own, and then via > Stunnel on both ends, and compare the results. Now you've got > apples-to-apples comparison. > > (Suggest you implement the server as an inetd-started application, > and start it from Stunnel via the 'exec' option, to keep the extra > cleartext TCP connection out of the mix.) > > Side possibilities: > > * Try alternate 'packet sizes' for comparison. > * Try different crypto protocols for comparison. > > > -- > Brian Hatch $it = $it || $another; > Systems and > Security Engineer > http://www.ifokr.org/bri/ Brian, Thank you for the advice and replying so quickly. Since my end goal was to see how additional network overhead due to security affects voice over IP (UDP), are there any other SSL enabled applications similar to Stunnel that supports UDP? (I am looking into Zebedee; however, it of course does not implement SSL.) Thanks again, Rutger Thomschutz -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

poll() rather than select() eta (4.0.6?)
by rocco.s 09 Nov '04

09 Nov '04

is stunnel 4.0.6 going to use poll() rather than select() (for more than 500/1024 clients et al) ala http://marc.theaimsgroup.com/?l=stunnel-users&m=108238799929981&w=2 and http://marc.theaimsgroup.com/?l=stunnel-users&m=108081347531925&w=2

2 1

(no subject)
by Edgar Hodge 08 Nov '04

08 Nov '04

un-subscribe stunnel-users(a)mirt.net

1 0

jailed stunnel can't find DNS
by conover＠rahul.net 08 Nov '04

08 Nov '04

My stunnel.conf file looks like: debug = 7 cert = /usr/local/stunnel/etc/stunnel/stunnel.pem chroot = /usr/local/stunnel/var/run/ pid = /stunnel.pid output = stunnel.log CAfile = /usr/local/stunnel/etc/stunnel/certs.pem verify = 3 delay = yes client = yes setuid = stunnel setgid = stunnel . . . and the stunnel.log file: . . . 2004.11.07 16:49:10 LOG7[3794:1025]: smtps started 2004.11.07 16:49:10 LOG5[3794:1025]: smtps connected from 127.0.0.1:1143 2004.11.07 16:49:10 LOG3[3794:1025]: Failed to resolve hostname 'abc.wxyz.net' 2004.11.07 16:49:10 LOG3[3794:1025]: Failed to initialize remote connection 2004.11.07 16:49:10 LOG7[3794:1025]: smtps finished (0 left) Removing chroot in stunnel.conf fixes the problem, but its no longer jailed. Hints? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

3 3

Using qmail with stunnel
by conover＠rahul.net 08 Nov '04

08 Nov '04

Someone ask about using qmail with stunnel. In /var/qmail/control/smtproutes, put: :localhost:12325 Which routes all undeliverable/default email traffic to localhost, port 12325. And in /usr/local/stunnel/etc/stunnel/stunnel.conf, put: [smtps] accept=12325 connect=myremote.com:32125 (man(1) qmail-control(5) for particulars,) so the local stunnel will know what to do with it-route it to myremote.com, port 32125. And in myremote.com's stunnel.conf, put: [smtps] accept=32125 connect=localhost:25 so myremote.com will route it to localhost, port 25, smtp. Works fine on TCP/A?DSL, or a demand dial PPP connection, bringing the telco line up for the email transaction, and then disconnecting, (kind of like UUCP.) If a multi-user dial connection, it is advisable to put the number '1' in /var/qmail/control/concurrencyremote, (without the single quotes,) to throttle the number of concurrent transactions going down the line, else if there are a bunch of messages in qmail's queue when the connection is made, qmail will choke the line with 20, (the default,) concurrent transactions to empty the queue-and no one will be able to get a packet in edgewise down the PPP link. John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

How to configure Stunnel for ICMP packets?
by Rutger Thomschitz 08 Nov '04

08 Nov '04

Dear group, I have just started using Stunnel 4.04 with OpenSSL. This may seem a bit strange, but, I would like to configure Stunnel such that it will encrypt all my Ping packets. The reason in a nut shell is that I would like to use Ping to determine the network overhead added by SSL, as part of my research. How can I set up stunnel (i.e. stunnel.conf) to tunnel all ICMP (i.e. Ping) packets? Thank you very much in advance. I look forward to any replies. Sincerely, Rutger olds76(a)email.com -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm

2 1

(no subject)
by isidore11 07 Nov '04

07 Nov '04

1 0

RE: [stunnel-users] UDP End-points
by Les Niles 06 Nov '04

06 Nov '04

Pardon my ignorance, but why not run PPP over stunnel and then UDP over that? No new encapsulation to invent. Performance would be lousy, so it would be stupid to use for some streaming media protocol, but for low-bandwidth UDP-based protocols like NTP, DNS, RADIUS, etc. it might well be useful. -les -----Original Message----- From: stunnel-users-bounces(a)mirt.net On Behalf Of Michal Trojnara Subject: Re: [stunnel-users] UDP End-points Leigh, > Perhaps I wasn't quite as clear as I intended.. :) > I'm not suggesting that SSL over UDP should be done.. I'm suggesting > that stunnel could potentially act as a UDP-over-encrypted-TCP > gateway. Okay. Now I understand your idea (I hope). I would have to design a propriatary datagram-over-byte-stream (DOBS) protocol (at least length of UDP packets has to be encoded aside from the content), and then tunnel UDP over DOBS over SSL over TCP. This is why I don't like it: 1. Such tunneling is not very effective. There's a *huge* protocol overhead. 2. It's not standard. One of the main ideas behind stunnel is its interoperability. 3. I think it's much easier to write such encrypting UDP forwarder from scratch using IPSec-style datagram protocol, than to modify stunnel. 4. It breaks my KISS principle. 8-) In fact I would really like to find a time (or a sponsor) to develop such UDP encrypting forwarder. BTW: Maybe it's better to use IPSec or VTUN instead of a proxy? Best regards, Mike

2 1

Stunnel not working with Qmail
by Paul Swainson 06 Nov '04

06 Nov '04

Hi to all list members, I will try to as descriptive as possible about the problem. I have a qmail install and I had used courier for imap, imapssl & pop3dssl. I wanted to implement smtp ssl. I have gone through the stuff at stunnel.org but I don't think its my qmail config that's the problem. This is the first time I have used stunnel, I compiled no probs and before doing so I installed open ssl 0.9.7e I have created a conf for stunnel and here it is: Cat /usr/local/etc/stunnel/smtpsd.conf cert = /usr/local/etc/stunnel/stunnel.pem exec = /var/qmail/bin/qmail-smtpd #******** execargs = /var/qmail/bin/qmail-smtpd mydomain.com /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1 #******** client = yes foreground = yes in the qmail run (smtpsd) script I have amended it to read #!/bin/sh QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" export QMAILQUEUE QMAILDUID=`id -u vpopmail` NOFILESGID=`id -g vpopmail` MAXSMTPD=`cat /var/qmail/control/concurrencyincoming` LOCAL=`head -1 /var/qmail/control/me` if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL" ]; then echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in echo /var/qmail/supervise/qmail-smtpd/run exit 1 fi if [ ! -f /var/qmail/control/rcpthosts ]; then echo "No /var/qmail/control/rcpthosts!" echo "Refusing to start SMTP listener because it'll create an open relay" exit 1 fi exec /usr/local/bin/softlimit -m 40000000 \ /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \ -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \ #********* /usr/local/sbin/stunnel /usr/local/etc/stunnel/smtpsd.conf #********* Execargs has in the stunnel conf is the line from smtpd run script, when it runs I don't have any output to the log so I can only assume stunnel is dying before it starts the session. Has anyone got this working? I know that it can but a lot of examples are for pop3ds. If I type stunnel /usr/local/etc/stunnel/smtpsd.conf I get the following error: Unable to open "/dev/cryptonet" Any help on this would be much appreciated, Thanks Regards Paul Swainson

2 1