- stunnel-users - stunnel.org

Stunnel & Java SSL
by richard＠oversight.co.nz 28 Oct '04

28 Oct '04

I'm developing a website where a java applet is downloaded over an https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. The applet codebase in the html code is set to https://x.x.x.x:1080/xxxx.jar To complicate this issue, Stunnel is set to verify=3 i.e. it requires a valid client certificate. It seems that the java implementation of SSL (JVM 1.4.1_03) won't respond to prompts for client certificates?? Stunnel simply times out with the following error.... 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in non-blocking mode 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) 2004.10.29 11:45:34 LOG7[6898:7171]: service started 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state (accept): before/accept initialization2004.10.29 11:45:34 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 flush data 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service finished (0 left) Does anyone know a way around this? Thank you, Richard Watson

1 0

Session resumption
by Rick Cone, Secure Payment Systems 27 Oct '04

27 Oct '04

I use Stunnel 4.03 I have been working on a project with some slow POS equipment trying to do SSL connections. Because of the slow processors on these devices, we are trying to speed up the connection and transaction. The concept of "session resumption" came up. What is the best way to setup Stunnel to make subsequent connections faster with session resumption. Thanks, Rick Cone Secure Payment Systems 801 8th St. #150-D Greeley, CO 80631 970-352-9434 (office) 970-352-0122 (fax, call office first) rcone(a)securepaymentsystems.com Note: This electronic message and attachments, if any, contain information which is intended solely for the designated recipients. Unauthorized disclosure, copying, distribution, or other use of the contents of this message or attachments, in whole or in part, is prohibited without express authorization of the author of this message.

2 1

Connection crypted with pppd
by angelo.raspanti 27 Oct '04

27 Oct '04

Mike wrote >Using chroot with exec is not trivial. Please make sure you know what >your're trying to do. 8-) OK, i have skip this argument, now i study better it and retry with a new configuration. Thanks

1 0

Outlook has problems with sending email
by Kenneth Simpson 27 Oct '04

27 Oct '04

Hi - I'm having problems with Stunnel 4.05 and Outlook - but not with Mozilla/Thunderbird. Unfortantely, most of our users use Outlook from Office 2000 and Office XP. The problem is Outlook can't send email when using SIMAP/SSMTP. If the remote users set their SMTP server to be their ISP, then Outlook doesn't have a problem. It suggests a sendmail issue except Mozilla/Thunderbird work fine. How do most people configure stunnel for Outlook? We're behind a screening router and port 587 - the so-called sendmail "submission" port - is currently closed. All ICMP is administratively disabled for this host at the router. But sendmail on this particular host is configured for port 587 behind the firewall. Is there a need to configure stunnel for port 587 too? We're using OpenSSL 0.9.7d Sendmail 8.12.10 Stunnel 4.0.5 SPARC Solaris 5.8 Enclosed is the stunnel.conf file. Under version 3.x roughly year ago things appeared to be working correctly - but we've upgraded both sendmail and SSL since then - and our users where migrating from Outlook Express to Outlook. Any ideas? I've added the options options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTbusy = 300 TIMEOUTclose = 60 TIMEOUTidle = 43200 but no help. Any help would greatly appreciated! -- Ken

2 1

Stunnel process die-off halfway
by PinLee_Su＠azuretech.com.sg 27 Oct '04

27 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance!

1 0

(no subject)
by PinLee_Su＠azuretech.com.sg 27 Oct '04

27 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance!

1 0

Connection crypted with pppd
by angelo.raspanti 27 Oct '04

27 Oct '04

I have a problem using stunnel v 4.05 under Linux with kernel 2.4.27. My target is using two PC connected via serial port with trafic crypted. I have achieved this schema: +-------+ +-------+ | | | | | PC1 |------------rs232---------| PC2 | | |10.0.0.1 10.0.0.2| | | | | | +-------+ +-------+ I have started pppd in raw mode in PC1 and PC2 and i have verified (with ping)that the link is OK for trafic without criptyng. Below i have tried to "mount" a tunnel cripted between PC1 and PC2 but stunnel server side return an error in openpty function. The stunnel.conf server side (PC1) is: -------------------------------------- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = setuid = nobody setgid = nobody # Some debugging stuff debug = 7 output = /var/log/stunnel.log foreground=no # Service-level configuration [ppp] accept = 2020 exec = /usr/sbin/pppd execargs = pppd local pty = yes The stunnel.conf client side (PC2) is: -------------------------------------- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = setuid = nobody setgid = nobody # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode client = yes connect = 10.0.0.1:2020 exec = /usr/sbin/pppd execargs = pppd local The log file server side (PC1) is: ---------------------------------- 2004.10.27 07:25:19 LOG5[5246:16384]: stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.10.27 07:25:19 LOG7[5246:16384]: RAND_status claims sufficient entropy for the PRNG 2004.10.27 07:25:19 LOG6[5246:16384]: PRNG seeded successfully 2004.10.27 07:25:19 LOG7[5246:16384]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:25:19 LOG7[5246:16384]: Key file: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:25:19 LOG5[5246:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2004.10.27 07:25:19 LOG7[5246:16384]: FD 4 in non-blocking mode 2004.10.27 07:25:19 LOG7[5246:16384]: SO_REUSEADDR option set on accept socket 2004.10.27 07:25:19 LOG7[5246:16384]: ppp bound to 0.0.0.0:2020 2004.10.27 07:25:19 LOG7[5246:16384]: FD 5 in non-blocking mode 2004.10.27 07:25:19 LOG7[5246:16384]: FD 6 in non-blocking mode 2004.10.27 07:25:19 LOG7[5247:16384]: No pid file being created 2004.10.27 07:25:59 LOG7[5247:16384]: ppp accepted FD=7 from 10.0.0.2:39791 2004.10.27 07:25:59 LOG7[5247:16384]: FD 7 in non-blocking mode 2004.10.27 07:25:59 LOG7[5251:16386]: ppp started 2004.10.27 07:25:59 LOG5[5251:16386]: ppp connected from 10.0.0.2:39791 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): before/accept initialization 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: FD=7, DIR=read 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: ok 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 read client hello A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write server hello A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write certificate A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write server done A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 flush data 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: FD=7, DIR=read 2004.10.27 07:26:00 LOG7[5251:16386]: waitforsocket: ok 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 read client key exchange A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 read finished A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 write change cipher spec A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 write finished A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 flush data 2004.10.27 07:26:00 LOG7[5251:16386]: 1 items in the session cache 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client connects (SSL_connect()) 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client connects that finished 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client renegotiatations requested 2004.10.27 07:26:00 LOG7[5251:16386]: 1 server connects (SSL_accept()) 2004.10.27 07:26:00 LOG7[5251:16386]: 1 server connects that finished 2004.10.27 07:26:00 LOG7[5251:16386]: 0 server renegotiatiations requested 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache hits 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache misses 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache timeouts 2004.10.27 07:26:00 LOG6[5251:16386]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.10.27 07:26:00 LOG7[5251:16386]: pty_allocate:namebuf=, namebuflen=1024 : Success (0) 2004.10.27 07:26:00 LOG3[5251:16386]: openpty: No such file or directory (2) 2004.10.27 07:26:00 LOG3[5251:16386]: Failed to initialize remote connection 2004.10.27 07:26:00 LOG7[5251:16386]: ppp finished (0 left) The log file client side (PC2) is: ---------------------------------- 2004.10.27 07:20:16 LOG5[4460:16384]: stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.10.27 07:20:16 LOG7[4460:16384]: RAND_status claims sufficient entropy for the PRNG 2004.10.27 07:20:16 LOG6[4460:16384]: PRNG seeded successfully 2004.10.27 07:20:16 LOG7[4460:16384]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:20:16 LOG7[4460:16384]: Key file: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:20:16 LOG7[4460:16384]: stunnel started 2004.10.27 07:20:16 LOG6[4460:16384]: Local mode child started (PID=4461) 2004.10.27 07:20:16 LOG5[4460:16384]: stunnel connected from 127.0.0.1:39790 2004.10.27 07:20:16 LOG7[4460:16384]: FD 4 in non-blocking mode 2004.10.27 07:20:16 LOG7[4460:16384]: stunnel connecting 10.0.0.1:2020 2004.10.27 07:20:16 LOG7[4460:16384]: remote connect #1: EINPROGRESS: retrying 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: FD=4, DIR=write 2004.10.27 07:20:16 LOG3[4461:16384]: /usr/sbin/pppd: No such file or directory (2) 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:16 LOG7[4460:16384]: Remote FD=4 initialized 2004.10.27 07:20:16 LOG7[4460:16384]: SSL state (connect): before/connect initialization 2004.10.27 07:20:16 LOG7[4460:16384]: SSL state (connect): SSLv3 write client hello A 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: FD=4, DIR=read 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server hello A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server certificate A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server done A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write client key exchange A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write finished A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 flush data 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: FD=4, DIR=read 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read finished A 2004.10.27 07:20:17 LOG7[4460:16384]: 1 items in the session cache 2004.10.27 07:20:17 LOG7[4460:16384]: 1 client connects (SSL_connect()) 2004.10.27 07:20:17 LOG7[4460:16384]: 1 client connects that finished 2004.10.27 07:20:17 LOG7[4460:16384]: 0 client renegotiatations requested 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server connects (SSL_accept()) 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server connects that finished 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server renegotiatiations requested 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache hits 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache misses 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache timeouts 2004.10.27 07:20:17 LOG6[4460:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.10.27 07:20:17 LOG7[4460:16384]: Socket closed on read 2004.10.27 07:20:17 LOG7[4460:16384]: SSL write shutdown (output buffer empty) 2004.10.27 07:20:17 LOG7[4460:16384]: SSL alert (write): warning: close notify 2004.10.27 07:20:17 LOG7[4460:16384]: SSL_shutdown retrying 2004.10.27 07:20:17 LOG3[4460:16384]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2004.10.27 07:20:17 LOG5[4460:16384]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2004.10.27 07:20:17 LOG7[4460:16384]: stunnel finished (0 left) Any suggestion ? Thanks in advance.. Angelo Raspanti

2 1

Stunnel process die-off halfway
by PinLee_Su＠azuretech.com.sg 25 Oct '04

25 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance! "Azure Technologies is the IT solutions provider of Hutchison Whampoa Limited and a member of Hutchison Global Communications Holdings Limited." The message is for information purposes only and is not intended to create legally binding relations. The shareholders, directors and management of Azure Technologies and any of its group companies accept no responsibility and accordingly shall have no liability to any party whatsoever with respect to the contents of this message. This message (including any attachments) is intended only for the use of the addressee(s) named above. It may contain information that is PRIVILEGED and CONFIDENTIAL and should not be read, copied or otherwise used by any other person. If you are not the intended recipient, please erase all copies of the message (including attachments) and notify us immediately.

1 0

Compiling v4.05 from source
by Ed Vazquez 23 Oct '04

23 Oct '04

On an up-to-date version of Linux, I get this error following a successful config: $ make Making all in src make[1]: Entering directory `/g/vs-build/stunnel-4.05/src' Makefile:404: warning: overriding commands for target `stunnel.exe' Makefile:265: warning: ignoring old commands for target `stunnel.exe' cd .. && automake --gnu --include-deps src/Makefile configure.ac:5: your implementation of AM_INIT_AUTOMAKE comes from an configure.ac:5: old Automake version. You should recreate aclocal.m4 configure.ac:5: with aclocal and run automake again. src/Makefile.am: required file `auto/depcomp' not found /usr/share/automake-1.9/am/depend2.am: am__fastdepCC does not appear in AM_CONDITIONAL /usr/share/automake-1.9/am/depend2.am: AMDEP does not appear in AM_CONDITIONAL make[1]: *** [Makefile.in] Error 63 make[1]: Leaving directory `/g/vs-build/stunnel-4.05/src' make: *** [all-recursive] Error 1 After running aclocal (completes with no errors), I re-run configure and try to make again: $ make Making all in src make[1]: Entering directory `/g/vs-build/stunnel-4.05/src' Makefile:404: warning: overriding commands for target `stunnel' Makefile:265: warning: ignoring old commands for target `stunnel' cd .. && automake-1.9 --gnu --include-deps src/Makefile src/Makefile.am: required file `auto/depcomp' not found make[1]: *** [Makefile.in] Error 1 make[1]: Leaving directory `/g/vs-build/stunnel-4.05/src' make: *** [all-recursive] Error 1 Ideas? Suggestions? Did I screw something up? Ed Vazquez To speak ill of others is a dishonest way of praising ourselves. . . let us be above such transparent egotism. - Will Durant

2 1

stunnel with SHOUTcast
by grimholtz＠mailbolt.com 20 Oct '04

20 Oct '04

Anyone gotten stunel to work with SHOUTcast or another streaming audio server? Regards, Eric Jung

3 2

stunnel with netcat.
by Graeme Stewart 19 Oct '04

19 Oct '04

I'm hoping someone on this list will take the time to help me. I apologize for the newbie nature of this question. I'm trying to create an SSL stunnel connection to an https URL then utilize netcat to send requests through that previously established link. I believe this should be possible. My configuration file includes: verify=0 client=yes [https] accept=localhost:8080 connect=www.remotesite.com:443 TIMEOUTEclose=0 transparent=yes Whenever I run: # stunnel stunnel.config # nc -vv localhost 8080 I receive a connection refused error from netcat. Could someone point me in the right direction? I did review the examples on stunnel.org but they all seem to reference an earlier version of stunnel. Thanks, Graeme

2 5

any way to search the archives?
by grimholtz＠mailbolt.com 19 Oct '04

19 Oct '04

Hi, Is there any way to search the archives at http://mirt.net/pipermail/stunnel-users/ or do I just have to go through them manually? Thank you for any reply, Eric Jung

2 1

Stunnel and streaming audio
by grimholtz＠mailbolt.com 19 Oct '04

19 Oct '04

Hi, I'm using stunnel 4.05 on Windows 2000 for both client and server. I have VNC working just fine over port 443. Now I want to stream audio from the server to the client over port 21 with stunnel and any streaming audio server. I can't get this to work. I'm currently using Windows Media Encoder for streaming because it is simple and free, but I don't mind switching to SHOUTcast or something else. This is the stunnel server configuration: CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 [vnc] accept = 443 connect = 127.0.0.1:15351 [audiostream] accept = 21 connect = 127.0.0.1:80 On the client-side, I have this configuration: CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 [vnc] accept = 127.0.0.1:15351 connect = someurl.com:443 [audiostream] accept = 127.0.0.1:80 connect = someurl.com:21 VNC works fine but streaming audio does not. It doesn't matter if I change port 21 to something else; I get the same error. The output on the server-side stunnel console is: 2004.10.18 13:16:02 LOG5[2036:1732]: audiostream connected from xxx.xxx.xxx.xxx:59090 The output on the client-side stunnel console is: 2004.10.18 13:21:07 LOG5[1088:1300]: audiostream connected from 127.0.0.1:1467 2004.10.18 13:21:07 LOG3[1088:1300]: SSL_connect: Peer suddenly disconnected stunnel -version on the server-side displays this info: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds 2004.10.18 20:47:05 LOG3[1316:2092]: Server is down openssl version on the server-side displays this info: OpenSSL 0.9.7d 17 Mar 2004 Anyone have ideas? Thank you in advance for any advice, Eric Jung

1 0

Client certificates still valid after removal with verify = 3
by Michael Brown 18 Oct '04

18 Oct '04

I'm having a problem with my stunnel 4.05 setup: We are using a setup where each client that connects has to have a valid certificate present on the filesystem (verify = 3). After the client connects once, it seems that the certificate is cached by either the SSL libraries or stunnel: stunnel.conf: <<< cert = /etc/stunnel/servercert.pem CAfile = /usr/share/ssl/CA/cacert.pem CApath = /etc/stunnel/clientdb verify = 3 [https] accept = 443 connect = remote.server.name:443 local = 192.168.0.6 >>> Some output: Oct 15 19:36:34 machine stunnel[14139]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:36:34 fruitfly stunnel[14139]: VERIFY OK: depth=0, /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com ... and the same thing after I remove the hash link in /etc/stunnel/clientdb. But only after I restart does it to the right thing: Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com Help! We don't want to have to restart stunnel every time we remove a user. Thanks, Michael Brown -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

2 1

New feature
by Michal Trojnara 18 Oct '04

18 Oct '04

Dear Users, New line in stunnel 4.06 ChangeLog: - Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. What do you think? Best regards, Mike

7 9

Using stunnel with HTTP as server and client
by Wayne A Collins 14 Oct '04

14 Oct '04

I am new to the product and encryption as well, but am looking for some unix examples using with an HTTP client and a server to communicate with HTTP/S applications. I have looked through the archives, but they only go back 3 months. I know this has had to have been done many times but am missing something. Thanks, Wayne A. Collins IBM Global Services IT Architect, eBI - Communications & Public Sectors wacollin(a)us.ibm.com 941-792-0448 Office 800-759-8888 Pin # 1019403 Pager

3 2

Re: Problem running Stunnel
by Olivier Kaloudoff 13 Oct '04

13 Oct '04

Hi Robert, > When I run stunnel nothing seems to be happening. The terminal > accepts the command but does nothing. The log file doesn't produce any > output either nor does running stunnel in the foreground. (...) > What is meant to happen when I run stunnel, is there a way that I > can test if it is working. I previously tested imapd using telnet 0 143. > I'm using this > http://www.stepwise.com/Articles/Workbench/eart.4.0.html > article but its out of date, uses 3.x command line inputs, so I've tried > to convert those to the config file. put the following in your stunnel.conf to have useful debugging informations for 4.x: # Some debugging stuff debug = 7 output = /tmp/stunnel.log # comment out pid = line, that causes problems. # (to be re-enabled later if you need) # pid = /tmp/stunnel.pid launch your stunnel process with the following: stunnel stunnel.conf and watch your logfile at the same time: tail -f /tmp/stunnel.log Regards, Olivier

1 0

Stunnel V4.05 error with rsync
by craig hobbs 12 Oct '04

12 Oct '04

Hello, I am using stunnel v4.05 with rsync v2.6.0 and solaris9 as both my client and server machine. I am running rsync in daemon mode on the server and starting an rsync transfer on the client. I am getting a frequent error where my rsync client process just appears to hang. On the client side I will receive several 'SSL_read returned WANT_: retrying/SSL_write returned WANT_: retrying' messages back-to-back and then finally the message is always 'Socket closed on read'. Some data does get transferred but it appears from the messages that the socket looses its connection, and the the rsync process just hangs until time-out. Currently in no-blocking mode with the following limits: FD_SETSIZE=1024, file ulimit=2147483647 -> 500 clients allowed Is there any stunnel bug or system resource limit that could be the problem ?? Thanks for the help. ~Craig stunnel.conf file example from client: # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 cert = /usr/local/etc/stunnel/stunnel.pem #chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/tmp/stunnel.pid #setuid = nobody #setgid = nogroup # Some debugging stuff debug = 7 output = /var/tmp/stunnel.log foreground = yes # Use it for client mode client = yes # Service-level configuration [rsync] accept = 8000 connect = some_host.com:20000 stunnel log file example from client: 2004.10.11 14:44:32 LOG7[26651:7]: rsync started 2004.10.11 14:44:32 LOG5[26651:7]: rsync connected local_host_ip:43586 2004.10.11 14:44:32 LOG7[26651:7]: FD 9 in non-blocking mode 2004.10.11 14:44:32 LOG7[26651:7]: rsync connecting remote_host_ip:20000 2004.10.11 14:44:32 LOG7[26651:7]: remote connect #1: EINPROGRESS: retrying 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=write 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: Remote FD=9 initialized 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): before/connect initialization 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write client hello A 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=read 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read server hello A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 flush data 2004.10.11 14:44:32 LOG7[26651:7]: 3 items in the session cache 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects (SSL_connect()) 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 client renegotiatations requested 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects (SSL_accept()) 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 server renegotiatiations requested 2004.10.11 14:44:32 LOG7[26651:7]: 3 session cache hits 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache misses 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache timeouts 2004.10.11 14:44:32 LOG6[26651:7]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc =AES(256) Mac=SHA1 2004.10.11 14:44:59 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:44:59 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL socket closed on SSL_read

2 1

connection timeout
by SqM 10 Oct '04

10 Oct '04

Hi! I have an application that itself has the possibility to use a backup server. I.e config of primary and secondary server. I have set up the application to connect to localhost on 2 different ports ( 1000 and 1001 ) and each of the ports are forwarded to a primary and secondary server. When testing this setup i find that if i route packets to the primary server to /dev/null in order for the application to select the secondary server the application seems to be happy since stunnel answers. After aproxx 300 seconds i can see in the log that stunnel gives up and that the application sees this. The appliation then happily selects the secondary server. The question then is if it is possible to make stunnel a little bit faster in giving up.. I.e. perhaps 30 sec instead of 300 sec. I found one setting in the client config that seems to do this but the question is.. Is this the correct way to do it.. I.e. setting "TIMEOUTbusy = 30 seconds" seems to fix my problem but is this the rigth way or is there a better way? /Sqm

2 2

RE: [stunnel-users] RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 10 Oct '04

10 Oct '04

I have more information. I commented out chroot in the config file and it works. #chroot = /usr/local/var/run/stunnel/ -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]]On Behalf Of Garg, Jai V (Jai) Sent: Friday, October 08, 2004 6:04 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] RE: stunnel on Solaris 2.6 or 7? I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 -----Original Message----- From: Garg, Jai V (Jai) Sent: Friday, October 08, 2004 3:42 PM To: stunnel-users(a)mirt.net Subject: stunnel on Solaris 2.6 or 7? Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

2 2

NFS over Stunnel
by E SA 09 Oct '04

09 Oct '04

Hi, Is there anbody running NFS over Srunnel? I need to do so for Solaris. Can this be done? Has anybody done it? Any pointers? Beforehand, thank you for your help. Best regards, Erick Sanz _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

3 2

RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 08 Oct '04

08 Oct '04

I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 > -----Original Message----- > From: Garg, Jai V (Jai) > Sent: Friday, October 08, 2004 3:42 PM > To: stunnel-users(a)mirt.net > Subject: stunnel on Solaris 2.6 or 7? > > Hello, > Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. > I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: > > 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 > 04 > 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG > 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully > 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed > 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket > 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 > 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid > 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 > 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode > > I appreciate all help with this. > > Jai

1 0

stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 08 Oct '04

08 Oct '04

Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

1 0

Compilation problem of stunnel-4.05 on solaris 9
by Nada Machkova CEI-OI Banska Bystrica 08 Oct '04

08 Oct '04

Hi Didier try to find and set direct path to the ssl/lib before ./configure setenv LD_LIBRARY_PATH /usr/openwin/lib:/usr/dt/lib:/usr/local/lib:/usr/local/ssl/lib ./configure ... Nada

1 0

Stunnel question
by Rick Cone, Secure Payment Systems 06 Oct '04

06 Oct '04

I use Stunnel as a server that connects locally to a port with an application running (called Mlink). The software on that port will only allow 1 connection on the port at a time, not achieving a (true) socket server environment. Does anyone know of a piece of software (like a load balancer) that would accept connections on a specific port (from Stunnel in this case...), and then round-robin connections (or something thereof) to a set of ports? Thanks, Rick Cone Secure Payment Systems 801 8th St. #150-D Greeley, CO 80631 970-352-9434 (office) 970-352-0122 (fax, call office first) rcone(a)securepaymentsystems.com Note: This electronic message and attachments, if any, contain information which is intended solely for the designated recipients. Unauthorized disclosure, copying, distribution, or other use of the contents of this message or attachments, in whole or in part, is prohibited without express authorization of the author of this message.

2 1

Problem running Stunnel
by Robin Martin 06 Oct '04

06 Oct '04

When I run stunnel nothing seems to be happening. The terminal accepts = the command but does nothing. The log file doesn't produce any output = either nor does running stunnel in the foreground. As I understand it, I am trying to wrap my imapd server using stunnel. = Obviously installed imapd, and openssl.=20 In my config file I've got [imaps] accept =3D 993 exec =3D /usr/local/libexec/imapd execargs =3D imapd What is meant to happen when I run stunnel, is there a way that I can = test if it is working. I previously tested imapd using telnet 0 143. I'm = using this=20 http://www.stepwise.com/Articles/Workbench/eart.4.0.html article but its out of date, uses 3.x command line inputs, so I've tried = to convert those to the config file. Thanks, your help is greatly appreciated. Regards, ---- Robin Martin Email: robmar(a)gmail.com

1 0

stunnel dies on win32 - Try again with out HTML
by Richard Whiffen 05 Oct '04

05 Oct '04

We have a problem where stunnel dies on our Win32 boxes when we attempt load tests: stunnel 4.05 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds When we had one stunnel.cnf for all services it would crash almost imediately (less than a minute after starting the load). When we created separate processes for each target server it lasts longer, 5 to 10 minutes, but still dies. The frustrating part is we get no indications in the log files of what's going on. It dies in seemingly random spots. The last log entry is never the same and there's nothing in the cmd window that launched it to indicate what happened. The conf is fairly simple: #script test conf cert = \stunnel\ohetestisg1.pem Cafile = \stunnel\css-ca-cert.pem CApath = \stunnel\certs output = \stunnel\stunnel-media.log #verify = 3 client = yes debug = 7 [**mediaserver] accept = 127.0.0.3:80 connect = 10.162.130.26:444 TIMEOUTclose = 0 We're connecting to a Cisco Content Server Switch if that helps. So I'm wondering where to go next. Any ideas on how to troubleshoot this? Rich Whiffen _________________________________________________________________ Check out Election 2004 for up-to-date election news, plus voter tools and more! http://special.msn.com/msn/election2004.armx

1 0

stunnel dies on win32
by Richard Whiffen 05 Oct '04

05 Oct '04

1 0

Stunnel.org
by ramesh k 05 Oct '04

05 Oct '04

Hi I have one little problem with stunnel .I saw your source and document very instresting .But I cant able to compile your souce code [Stunnel.org] in windows xp @ vc++ envirnment.and I have downloaded supportive compiler mingw ,openssl & libssl32.dll and libeay32.dll . In that source syslog.h is not supporting for vc++ . So kindly reply with Clear details to compile that source Regds Ramesh.k

1 0

Re: [stunnel-users] Bug or bad configuration ?
by Michal Trojnara 04 Oct '04

04 Oct '04

Dear fwd, > stunnel: md_rand.c:312: ssleay_rand_add: Assertion `md_c[1] == > md_count[1]' > failed. > 2004.10.03 10:14:44 LOG5[30267:1024]: Received signal 15; terminating Your OpenSSL library is not properly compiled: http://lists.freebsd.org/pipermail/freebsd-bugs/2003-April/000362.html > # stunnel -version > stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7c 30 > Sep > 2003 You use an obsolete version of OpenSSL library. You should upgrade it. http://www.openssl.org/news/secadv_20040317.txt Best regards, Mike

2 1

Stunnel help
by Mohammed Riyaz 30 Sep '04

30 Sep '04

Hi, I have installed stunnel-4.05 along with openssl-0.9.7d. I am not able to run it in either daemon or client mode. I read through the stunnel.org webpage but could find any help. when i run /usr/local/sbin/stunnel -d 7898 -r 631 i get the following output. 2004.09.24 15:10:47 LOG3[4752:1073866848]: -d: No such file or directory (2) Syntax: stunnel [filename] | -fd [n] | -help | -version | -sockets filename - use specified config file instead of /usr/local/etc/stunnel/stunnel.conf -fd n - read the config file from specified file descriptor -help - get config file help -version - display version and defaults -sockets - display default socket options I have copied the sampel config file as /usr/local/etc/stunnel/stunnel.conf. what should i do to avoid this? Is there any good document avalibel explaing step by step installation and configuration of stunnel? Thank you, -Riyaz

2 1

stunnel: command not found
by Robin Martin 24 Sep '04

24 Sep '04

Hi Guys, I am trying to install stunnel-4.05 on Mac 10.2.8. I am following this http://www.stepwise.com/Articles/Workbench/eart.4.0.html article. I am up to Step 8: Testing your setup. The article is old, but I am aware that stunnel 4.* requires a configuration file rather than command line inputs. My config file is [imapd] accept = 993 exec = /usr/local/libexec/imapd execargs = imaps My problem is, when I run (taken from the article) sudo stunnel -c -f -r localhost:993 I get the following, stunnel: command not found Can I use command line arguments here? It seems to be a very non-specific error. While hunting around for an answer I read somewhere else that stunnel likes to die silently? So perhaps I am doing something wrong but getting a vague error message? Is there a log file that I can look at? Thank you for any help, it is appreciated and I hope I've provided sufficient information. Best Regards, Robin _________________________________________________________________ Find love today with ninemsn personals. Click here: http://ninemsn.match.com?referrer=hotmailtagline

2 1

stunnel: command not found
by Robin Martin 24 Sep '04

24 Sep '04

Hi Guys, I am trying to install stunnel-4.05 on Mac 10.2.8. I am following this http://www.stepwise.com/Articles/Workbench/eart.4.0.html article. I am up to Step 8: Testing your setup. The article is old, but I am aware that stunnel 4.* requires a configuration file rather than command line inputs. My config file is [imapd] accept = 993 exec = /usr/local/libexec/imapd execargs = imaps My problem is, when I run (taken from the article) sudo stunnel -c -f -r localhost:993 I get the following, stunnel: command not found Can I use command line arguments here? It seems to be a very non-specific error. While hunting around for an answer I read somewhere else that stunnel likes to die silently? So perhaps I am doing something wrong but getting a vague error message? Is there a log file that I can look at? Thank you for any help, it is appreciated and I hope I've provided sufficient information. Best Regards, Robin

1 0

rsync over stunnel 4
by Steven Timm 23 Sep '04

23 Sep '04

There's an example of rsync over stunnel at http://www.stunnel.org/examples/rsync_mike.html but it appears to be using stunnel 3 syntax. Has anyone successfully made this work using stunnel 4? right now /etc/stunnel.conf is same on client and server, has [rsync] accept = 2222 connect = 873 Steve Timm ------------------------------------------------------------------ Steven C. Timm, Ph.D (630) 840-8525 timm(a)fnal.gov http://home.fnal.gov/~timm/ Fermilab Computing Div/Core Support Services Dept./Scientific Computing Section Assistant Group Leader, Farms and Clustered Systems Group Lead of Computing Farms Team

1 0

performance data
by Michal Trojnara 21 Sep '04

21 Sep '04

Dear Users, I've prepared a table that summarizes my benchmarks. I hope you'll find it useful. http://stunnel.mirt.net/perf.html Best regards, Mike

1 0

Pass phrase dialog
by John Bradley 18 Sep '04

18 Sep '04

When I start stunnel 4.05, I am presented with a dialog that requests that I enter a pass phrase in order to access our private key. Is there anyway to bypass this dialog. I would like to add the pass phrase to the config file, so that the dialog isn't presented. Security isn't an issue. Our config file will be in a secure location. Otherwise, our operations people are going the have to know the pass phrase to start stunnel. Thanks for your help. John ---------------------------------------------- John Bradley Software Development Lava Trading Inc. 95 Morton Street, 4th Floor New York, NY 10014 Tel: 212.609.0162 Fax: 212.609.0101 www.lavatrading.com <http://www.lavatrading.com/> This communication (including attachments) contains information that may be confidential. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it (including, in any attachments) is strictly prohibited. If you have received this communication in error please notify us by e-mail or by telephone 212-609-0162 and then delete the e-mail and all attachments and any copies thereof.

2 1

unclosed connection issue
by Ken G 15 Sep '04

15 Sep '04

I'm running stunnel 3.xx with thttpd (an embedded http server) on a small embedded machine on a pci card running linux. Establishing ssh, ftp, and http connections and using OpenSSL has all worked fine since they've been installed. I've been experiencing a strange issue. It seems that stunnel fails (somehow) to inform https clients that the connection has been closed. The sequence of events that I'm observing goes like this: T+0.0s: https client initiates request on port 443 (https). T+0.1s: stunnel establishes connection with thttpd on port 80. T+0.4s: thttpd finishes and dies, closing connection with stunnel. T+0.5s: stunnel finishes sending thttpd's output to its client, and then stops, believing that it has finished that connection. If forked, this copy of stunnel dies. The client (internet explorer, firefox, mozilla... doesn't matter) still believes that the connection is active, and waits for additional data. T+10.5s: Roughly 10 seconds later the client decides that the server timed out and displays what has been sent so far, which is the entire page. The only visible symptom is that small webpages seem to take 10 seconds to load. The visible symptom, then, is that webpages below a certain size (where that size is determined by the browser's willingness to refresh its view as data is being sent) take about 10 seconds to load. Is it possible that this behavior is due to stunnel? _______________________________ Do you Yahoo!? Express yourself with Y! Messenger! Free. Download now. http://messenger.yahoo.com

1 0

verify option question
by Alaadin 13 Sep '04

13 Sep '04

hello, i am using stunnel4.x under linux in my server i set verify option level 3 and in my clinet i added stunnel.pem so verify can happen now can my isp knows my key of encrytion and decrypt ? so it is safe to set verify level 3 ? or it shouldnot ? can my isp decrpt my traffic or knows what sites i visted? thanks

1 0

Wish: Option verify service-dependent
by Hans Werner Strube 13 Sep '04

13 Sep '04

With stunnel-4.x, it would be greatly desirable to make the option "verify" (and possibly the related certs) in stunnel.conf service-dependent rather than global. I have not looked at the code sufficiently to determine whether and how this could be possible.

2 1

Re: [stunnel-users] Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL _accept: Peer sudden ly disconnected
by Martin Kneissl 13 Sep '04

13 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michal Trojnara wrote: | | What about using my stunnel3 script instead? | | BTW: I really would like to know your comments on this script. | Does anyone need stunnel 3.x, now? | Unfortunately we will have to keep stunnel 3.x for some time (probably at least until next summer), due to a large distributed installation. I appreciate to have the wrapper script to migrate the current installations. If this was available when stunnel 4 was released we probably would have it in our installations right now... Anyone to verify my patch for stunnel-3.26? Best regards, Martin. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3-nr1 (Windows XP) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBRU5SnNbgBz1XxU4RAspgAJ9akmjZNTOig+YW69nRUCDX/hfTFwCfSwqL TKb3reUiIdYwVntSZSgQVgg= =wb9x -----END PGP SIGNATURE-----

1 0

Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL_accept: Peer sudden ly disconnected
by "Kneißl, Martin" 10 Sep '04

10 Sep '04

Hello everybody, I recompiled the newest "traditional" versions of OpenSSL and stunnel on Solaris, Linux, and HPUX. None of the defaults were changed except for --prefix and --openssldir/--with-ssl and --install_prefix Simple tests went through without problems on Linux and HPUX. For Solaris I have a big problem. Any help is appreciated, for example a trustworthy Stunnel-3.26 binary statically linked with OpenSSL 0.9.6m for Solaris 2.6 could also help. Summary ======= Stunnel listens on host medusa 12480 for SSL and forwards plain HTTP to apache on another host (sirius). When I try a HTTPS request to medusa:12480 using a browser or wget, the connection is broken immediately. When stunnel runs under the system call tracer truss the same commands succeed most of the time. In the truss output one can see an EAGAIN on the -r socket of stunnel. That might indicate that there is a problem when TCP buffers do not fill quickly receiving on the -r side. Details ======= Client side: (IP is 192.168.50.153) C:\>wget --spider https://medusa:12480 --12:59:18-- https://medusa:12480/ => `index.html' Resolving medusa... 192.168.41.13 Connecting to medusa[192.168.41.13]:12480... connected. Unable to establish SSL connection. Unable to establish SSL connection. Stunnel side: [mkn@medusa] stunnel-3.26 721$ ./stunnel -p ./stunnel.pem -D 7 -d 12480 -r sirius:80 -f -Pnone 2004.09.08 13:06:52 LOG5[29399:1]: Using 'sirius.80' as tcpwrapper service name 2004.09.08 13:06:52 LOG4[29399:1]: Wrong permissions on ./stunnel.pem 2004.09.08 13:06:52 LOG7[29399:1]: Snagged 64 random bytes from /nfss/home/mkn/.rnd 2004.09.08 13:06:53 LOG7[29399:1]: Wrote 1024 new random bytes to /nfss/home/mkn/.rnd 2004.09.08 13:06:53 LOG7[29399:1]: RAND_status claims sufficient entropy for the PRNG 2004.09.08 13:06:53 LOG6[29399:1]: PRNG seeded successfully 2004.09.08 13:06:53 LOG7[29399:1]: Certificate: ./stunnel.pem 2004.09.08 13:06:53 LOG5[29399:1]: stunnel 3.26 on sparc-sun-solaris2.6 PTHREAD+LIBWRAP with OpenSSL 0.9.6m 17 Mar 2004 2004.09.08 13:06:53 LOG7[29399:1]: No pid file being created 2004.09.08 13:06:53 LOG5[29399:1]: FD_SETSIZE=1024, file ulimit=64 -> 28 clients allowed 2004.09.08 13:06:53 LOG7[29399:1]: SO_REUSEADDR option set on accept socket 2004.09.08 13:06:53 LOG7[29399:1]: sirius.80 bound to 0.0.0.0:12480 2004.09.08 13:06:56 LOG7[29399:1]: sirius.80 accepted FD=7 from 192.168.50.153:1937 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 started 2004.09.08 13:06:56 LOG5[29399:4]: sirius.80 connected from 192.168.50.153:1937 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 connecting 192.168.41.223:80 2004.09.08 13:06:56 LOG7[29399:4]: Remote FD=9 initialized 2004.09.08 13:06:56 LOG7[29399:4]: Stunnel manual RSA blinding enabled 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): before/accept initialization 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 read client hello A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write server hello A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write certificate A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 write server done A 2004.09.08 13:06:56 LOG7[29399:4]: SSL state (accept): SSLv3 flush data 2004.09.08 13:06:56 LOG3[29399:4]: SSL_accept: Peer suddenly disconnected 2004.09.08 13:06:56 LOG7[29399:4]: sirius.80 finished (0 left) [mkn@medusa] stunnel-3.26 722$ ./stunnel -V stunnel 3.26 on sparc-sun-solaris2.6 PTHREAD+LIBWRAP with OpenSSL 0.9.6m 17 Mar 2004 Default behaviour: run in inetd mode (unless -d used) run in background (unless -f used) run in ssl server mode (unless -c used) Compile time defaults: -v level no verify -a directory (none) -A file (none) -S sources 2 -t timeout 300 seconds -B bytes 64 -D level 5 -P pid dir /opt/stunnel/var/stunnel/ -p pemfile in server mode: stunnel.pem in client mode: none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 8192 SO_SNDBUF -- -- -- 8192 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 255 TCP_NODELAY -- -- -- 0 [mkn@medusa] stunnel-3.26 724$ uname -a SunOS medusa 5.6 Generic_105181-39 sun4u sparc SUNW,Ultra-Enterprise [mkn@medusa] stunnel-3.26 726$ gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.6/2.95.2/specs gcc version 2.95.2 19991024 (release) When running the same stunnel under truss, I sometimes have success in retrieving the document, but sometimes I get: (...initialisation omitted...) poll(0xEFFFD4E0, 2, -1) = 1 fcntl(7, F_GETFL, 0x00000000) = 2 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D4) = 0 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D8) = 0 setsockopt(7, 65535, 8192, 0xEFFFF4DC, 4) = 0 fcntl(7, F_SETFL, 0x00000082) = 0 accept(7, 0xEFFFF5D0, 0xEFFFF548) = 8 fstat64(7, 0xEFFFF3D8) = 0 getsockopt(7, 65535, 8192, 0xEFFFF4DC, 0xEFFFF4D8) = 0 setsockopt(7, 65535, 8192, 0xEFFFF4DC, 4) = 0 fcntl(7, F_SETFL, 0x00000002) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 83) = 83 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 1 ] : s i r i u s . 8 0 a c c e p t e d F D = 8 f r o m 1 9 2 . 1 6 8 . 5 0 . 1 5 3 : 2 7 6 3\n fcntl(8, F_SETFD, 0x00000001) = 0 lwp_cond_signal(0xEF66B278) = 0 lwp_cond_wait(0xEF66B278, 0xEF66B288, 0xEF565C48) = 0 lwp_self() = 3 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 52) = 52 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 s t a r t e d\n brk(0x000F73A8) = 0 brk(0x000FF3A8) = 0 getpeername(8, 0x000F56C4, 0xEF20BC78) = 0 getpid() = 2339 [2337] getpeername(8, 0x000DF2E0, 0xEF20B44C) = 0 getsockname(8, 0x000DF2F0, 0xEF20B44C) = 0 open("/etc/hosts.allow", O_RDONLY) Err#2 ENOENT getpid() = 2339 [2337] open("/proc/2339/psinfo", O_RDONLY) = 9 read(9, "\f\0 F H\0\0\005\0\0\t #".., 336) = 336 close(9) = 0 fstat(-1, 0xEF209E40) Err#9 EBADF open("/dev/conslog", O_WRONLY) = 9 fcntl(9, F_SETFD, 0x00000001) = 0 fstat(9, 0xEF209E40) = 0 fstat(9, 0xEF20A8A0) = 0 time() = 1094642471 getpid() = 2339 [2337] putmsg(9, 0xEF209F58, 0xEF209F4C, 0) = 0 open("/etc/.syslog_door", O_RDONLY) = 10 door_info(10, 0xEF209E90) = 0 getpid() = 2339 [2337] door_call(10, 0xEF209E78) = 0 close(10) = 0 open("/etc/hosts.deny", O_RDONLY) Err#2 ENOENT fstat(9, 0xEF20A8A0) = 0 time() = 1094642471 getpid() = 2339 [2337] putmsg(9, 0xEF209F58, 0xEF209F4C, 0) = 0 open("/etc/.syslog_door", O_RDONLY) = 10 door_info(10, 0xEF209E90) = 0 getpid() = 2339 [2337] door_call(10, 0xEF209E78) = 0 close(10) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 79) = 79 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 5 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 c o n n e c t e d f r o m 1 9 2 . 1 6 8 . 5 0 . 1 5 3 : 2 7 6 3\n so_socket(2, 2, 0, "", 1) = 10 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 73) = 73 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 c o n n e c t i n g 1 9 2 . 1 6 8 . 4 1 . 2 2 3 : 8 0\n connect(10, 0xEF20BC00, 16) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 59) = 59 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : R e m o t e F D = 1 0 i n i t i a l i z e d\n time() = 1094642471 getpid() = 2339 [2337] time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 70) = 70 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : S t u n n e l m a n u a l R S A b l i n d i n g e n a b l e d\n time() = 1094642471 brk(0x000FF3A8) = 0 brk(0x001033A8) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 83) = 83 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : S S L s t a t e ( a c c e p t ) : b e f o r e / a c c e p t i n i t i a l i z a t i o n\n brk(0x001033A8) = 0 brk(0x001093A8) = 0 brk(0x001093A8) = 0 brk(0x0010D3A8) = 0 read(8, 0x00102C78, 11) Err#11 EAGAIN time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 73) = 73 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 3 [ 2 3 3 9 : 4 ] : S S L _ a c c e p t : P e e r s u d d e n l y d i s c o n n e c t e d\n setsockopt(10, 65535, 128, 0xEF20BC78, 8) = 0 close(10) = 0 setsockopt(8, 65535, 128, 0xEF20BC78, 8) = 0 close(8) = 0 time() = 1094642471 getpid() = 2339 [2337] write(4, 0x000E763C, 62) = 62 2 0 0 4 . 0 9 . 0 8 1 3 : 2 1 : 1 1 L O G 7 [ 2 3 3 9 : 4 ] : s i r i u s . 8 0 f i n i s h e d ( 0 l e f t )\n lwp_cond_signal(0xEF66B278) = 0 lwp_cond_wait(0xEF66B278, 0xEF66B288, 0xEF543CA0) = 0 lwp_mutex_unlock(0xEF66B288) = 0 lwp_mutex_lock(0xEF66B288) = 0 time() = 1094642471 lwp_mutex_lock(0xEF66B288) = 0 lwp_cond_broadcast(0xEF670F50) = 0 poll(0xEFFFD4E0, 2, -1) (sleeping...) With kind regards, Martin Kneissl _________________________ Atos Worldline GmbH CRM and Telco Pascalstrasse 19 52076 Aachen Germany Phone: +49 (0) 2408 148 173 Fax: +49 (0) 2408 148 204 mailto:[email protected] www.atosworldline.de

2 1

Unable to open "/dev/cryptonet"
by alaadin＠alaadin.org 09 Sep '04

09 Sep '04

hello, when i run stunnel4.x under linux it gaves statment Unable to open "/dev/cryptonet" but it run normal .. what this error mean ? does it means stunnel is running but not encrypting ? and is there any problem running stunnel without "/dev/cryptonet ? secand question i have stunnel4.x running with verify 3 option can my isp read data between me and the other host .. if i am transmiting data through stunnel ? thanks.

2 1

Stunnel-3.26 / OpenSSL 0.9.6m / Solaris / SSL_accept: Peer sudden ly disconnected
by "Kneißl, Martin" 08 Sep '04

08 Sep '04

Correcting my previous post, > ... one can see an EAGAIN on the -r socket of stunnel. That's not true, the EAGAIN is on the accepted file descriptor. The problem is not solved, though ... Martin.

2 1

ssl - excessive message size
by Olivier Rademakers 06 Sep '04

06 Sep '04

Hi All, I am having trouble with a secure connection that used to work until now. I am using an stunnel connection to transfer data from an ldap server(127.0.0.1) to Win Active Directory server (machineB.domain.com) in order to update AD with updated ldap data. I have run stunnel in high verbosity manually so I could extract a log of a connection attempt. Here it is below: # stunnel -c -f -D 7 -P /var/ldapad/ -d 127.0.0.1:6360 -r machineB.domain.com:636 LOG5[9318:1]: Using 'machineB.domain.com.636' as tcpwrapper service name LOG7[9318:1]: RAND_status claims sufficient entropy for the PRNG LOG6[9318:1]: PRNG seeded successfully LOG5[9318:1]: stunnel 3.14 on sparc-sun-solaris2.7 PTHREAD LOG7[9318:1]: Created pid file /var/ldapad/stunnel.machineB.domain.com.636.pid LOG7[9318:1]: machineB.domain.com.636 bound to 127.0.0.1:6360 LOG7[9318:4]: machineB.domain.com.636 started LOG5[9318:4]: machineB.domain.com.636 connected from 127.0.0.1:55001 LOG7[9318:4]: machineB.domain.com.636 connecting 172.27.24.4:636 LOG7[9318:4]: Remote host connected LOG7[9318:4]: before/connect initialization LOG7[9318:4]: before/connect initialization LOG7[9318:4]: SSLv3 write client hello A LOG7[9318:4]: SSLv3 read server hello A LOG7[9318:4]: SSLv3 read server certificate A LOG7[9318:4]: SSLv3 read server key exchange A LOG7[9318:4]: SSLv3 read server key exchange A LOG3[9318:4]: SSL_connect: error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size LOG7[9318:4]: machineB.domain.com.636 finished (0 left) I have searched for this error but to no avail and am wondering if any of you have already come across such, and if so would have the beginning of a solution, and why not The Solution ;-) NB: When running stunnel with the "-c" operand (client mode), it is said the certificates are optional. I have captured the dialogue between the two machines, and apparently, the problem would be coming from the AD server as the DN (Distinguished Name) in the cert is ~8000 bytes long. The capture reveals other errors, checksum and more, so if needed I could append those to the problem stated here. Again, unix-ldap side has not changed to my knowledge. The script has always been the same, and it worked until now. The ldap server is SUN Solaris 2.8 with ssl 0.9.7b Version of stunnel: stunnel 3.21 on sparc-sun-solaris2.8 PTHREAD The AD server is a Windows 2000 machine. Please enlighten me, Olivier

1 1

win32 stunnel - quiet service install
by Michael Brown 03 Sep '04

03 Sep '04

Greetings, It would be great if while installing as a service on win32, there was an option to install quietly - i.e. only pop up a dialog box to the user if there's a problem. Any chance of somebody nice compiling me a binary that does this? :) M. -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

1 0

stunnel.conf
by Bob Williams 02 Sep '04

02 Sep '04

I'm totally new to Stunnel, which I'm running on a Windows XP platform. Where can I find a newbie's tutorial, e.g. to tell me what stunnel expects to find in stunnel.conf? Many thanks for your help. -- Bob

1 0

FTP site
by Michal Trojnara 02 Sep '04

02 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, My ftp site is back online. Thanks to Brian Hatch for reporting the problem. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBN0vB/NU+nXTHMtERAqQ4AJ95KWL5PUpLZOMqQ4xOJYKqeVwgxgCfVIcc yMYncLDroE5wwHxJj5QtjGI= =Tryt -----END PGP SIGNATURE-----

1 0

stunnel3
by Michal Trojnara 01 Sep '04

01 Sep '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I've written a perl script to emulate stunnel 3.x command line with stunnel versions 4.05 and later. I hope you'll like it. It's ready for download here: ftp://stunnel.mirt.net/stunnel/stunnel3 Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBNkEq/NU+nXTHMtERAvVGAJ4yuDLNrCOFTLfuuFRIzwShDkd/lwCfcVLa bLhgSAs2gXuzca8ZkJmCb9Q= =SInU -----END PGP SIGNATURE-----

1 0

Samba and stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

just wondering if anybody has had any difficulties with wrapping samba with stunnel, Sambo 3.0 apparently has dropped the support for ssl and therefore we are now also considering using stunnel to wrap Samba. thanks -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

1 0

Marketing Stunnel
by Charles A. Monteiro 01 Sep '04

01 Sep '04

So I now need to sell stunnel to those that make decisions. It would be helpful to get an understanding of how widely deployed it is. It also would be useful to have a number of company names that I could drop, especially if said companies were major corporations and especially if they were players in the finance/banking industry. thanks in advance, -Charles -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

4 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users