stunnel-users

2 participants
3307 discussions

permanent tunnel
by Ramin Dousti 29 Oct '04

29 Oct '04

Hello, I'd like to set up an stunnel between two hosts which currently talk to each other unencrypted. The communication between these two hosts is HTTP and sporadic. What I'd like to achieve is a permanent stunnel between the hosts regardless of their communiucation pattern. Is this possible? And if yes, how? The current setup utilizes stunnel in server mode on the server side and stunnel in client mode on the client side. When a client issues a request, I see that an SSL tunnel is set up between the hosts and after the reception of the reply, the SSL tunnel is torn down. So, the question is, how can I nail down the SSL tunnel to be permanent? Thank you in advance, Ramin

2 1

SSL read returned WANT_: retrying
by Hacker, Dietmar 29 Oct '04

29 Oct '04

Has anybody a solution to this problem ? There was a thread about this msg in June. I am using a central Source staging server for my windows applications accessed via stunnel from remote over a Linux stunnel on the Internet gateway. Centrally I use SuSE Linux 8.2 with stunnel 4.04 and on the clients the current 4.05 windows binary version (also does not work with the older 4.04 windows binary version). The "SourceSave" Software does a directory comparision and then a download of all changed components. Without stunnel no problem. With stunnel after some traffic I always get "SSL returned WANT_: retrying" in the stunnel window and then the software stops downloading. Mit freundlichen Gruessen / With regards Dipl. Ing. Dietmar Hacker Grazer Wechselseitige Versicherung AG A-8010 Graz, Herrengasse 18-20 Tel.: +43 (316) 8037-256 Fax.: +43 (316) 8037-1256 mailto:[email protected]

2 1

Stunnel & Java SSL
by richard＠oversight.co.nz 28 Oct '04

28 Oct '04

I'm developing a website where a java applet is downloaded over an https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. The applet codebase in the html code is set to https://x.x.x.x:1080/xxxx.jar To complicate this issue, Stunnel is set to verify=3 i.e. it requires a valid client certificate. It seems that the java implementation of SSL (JVM 1.4.1_03) won't respond to prompts for client certificates?? Stunnel simply times out with the following error.... 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in non-blocking mode 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) 2004.10.29 11:45:34 LOG7[6898:7171]: service started 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state (accept): before/accept initialization2004.10.29 11:45:34 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 flush data 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service finished (0 left) Does anyone know a way around this? Thank you, Richard Watson

1 0

Session resumption
by Rick Cone, Secure Payment Systems 27 Oct '04

27 Oct '04

I use Stunnel 4.03 I have been working on a project with some slow POS equipment trying to do SSL connections. Because of the slow processors on these devices, we are trying to speed up the connection and transaction. The concept of "session resumption" came up. What is the best way to setup Stunnel to make subsequent connections faster with session resumption. Thanks, Rick Cone Secure Payment Systems 801 8th St. #150-D Greeley, CO 80631 970-352-9434 (office) 970-352-0122 (fax, call office first) rcone(a)securepaymentsystems.com Note: This electronic message and attachments, if any, contain information which is intended solely for the designated recipients. Unauthorized disclosure, copying, distribution, or other use of the contents of this message or attachments, in whole or in part, is prohibited without express authorization of the author of this message.

2 1

Connection crypted with pppd
by angelo.raspanti 27 Oct '04

27 Oct '04

Mike wrote >Using chroot with exec is not trivial. Please make sure you know what >your're trying to do. 8-) OK, i have skip this argument, now i study better it and retry with a new configuration. Thanks

1 0

Outlook has problems with sending email
by Kenneth Simpson 27 Oct '04

27 Oct '04

Hi - I'm having problems with Stunnel 4.05 and Outlook - but not with Mozilla/Thunderbird. Unfortantely, most of our users use Outlook from Office 2000 and Office XP. The problem is Outlook can't send email when using SIMAP/SSMTP. If the remote users set their SMTP server to be their ISP, then Outlook doesn't have a problem. It suggests a sendmail issue except Mozilla/Thunderbird work fine. How do most people configure stunnel for Outlook? We're behind a screening router and port 587 - the so-called sendmail "submission" port - is currently closed. All ICMP is administratively disabled for this host at the router. But sendmail on this particular host is configured for port 587 behind the firewall. Is there a need to configure stunnel for port 587 too? We're using OpenSSL 0.9.7d Sendmail 8.12.10 Stunnel 4.0.5 SPARC Solaris 5.8 Enclosed is the stunnel.conf file. Under version 3.x roughly year ago things appeared to be working correctly - but we've upgraded both sendmail and SSL since then - and our users where migrating from Outlook Express to Outlook. Any ideas? I've added the options options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTbusy = 300 TIMEOUTclose = 60 TIMEOUTidle = 43200 but no help. Any help would greatly appreciated! -- Ken

2 1

Stunnel process die-off halfway
by PinLee_Su＠azuretech.com.sg 27 Oct '04

27 Oct '04

1 0

(no subject)
by PinLee_Su＠azuretech.com.sg 27 Oct '04

27 Oct '04

1 0

Connection crypted with pppd
by angelo.raspanti 27 Oct '04

27 Oct '04

I have a problem using stunnel v 4.05 under Linux with kernel 2.4.27. My target is using two PC connected via serial port with trafic crypted. I have achieved this schema: +-------+ +-------+ | | | | | PC1 |------------rs232---------| PC2 | | |10.0.0.1 10.0.0.2| | | | | | +-------+ +-------+ I have started pppd in raw mode in PC1 and PC2 and i have verified (with ping)that the link is OK for trafic without criptyng. Below i have tried to "mount" a tunnel cripted between PC1 and PC2 but stunnel server side return an error in openpty function. The stunnel.conf server side (PC1) is: -------------------------------------- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = setuid = nobody setgid = nobody # Some debugging stuff debug = 7 output = /var/log/stunnel.log foreground=no # Service-level configuration [ppp] accept = 2020 exec = /usr/sbin/pppd execargs = pppd local pty = yes The stunnel.conf client side (PC2) is: -------------------------------------- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = setuid = nobody setgid = nobody # Some debugging stuff debug = 7 output = /var/log/stunnel.log # Use it for client mode client = yes connect = 10.0.0.1:2020 exec = /usr/sbin/pppd execargs = pppd local The log file server side (PC1) is: ---------------------------------- 2004.10.27 07:25:19 LOG5[5246:16384]: stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.10.27 07:25:19 LOG7[5246:16384]: RAND_status claims sufficient entropy for the PRNG 2004.10.27 07:25:19 LOG6[5246:16384]: PRNG seeded successfully 2004.10.27 07:25:19 LOG7[5246:16384]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:25:19 LOG7[5246:16384]: Key file: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:25:19 LOG5[5246:16384]: FD_SETSIZE=1024, file ulimit=1024 -> 500 clients allowed 2004.10.27 07:25:19 LOG7[5246:16384]: FD 4 in non-blocking mode 2004.10.27 07:25:19 LOG7[5246:16384]: SO_REUSEADDR option set on accept socket 2004.10.27 07:25:19 LOG7[5246:16384]: ppp bound to 0.0.0.0:2020 2004.10.27 07:25:19 LOG7[5246:16384]: FD 5 in non-blocking mode 2004.10.27 07:25:19 LOG7[5246:16384]: FD 6 in non-blocking mode 2004.10.27 07:25:19 LOG7[5247:16384]: No pid file being created 2004.10.27 07:25:59 LOG7[5247:16384]: ppp accepted FD=7 from 10.0.0.2:39791 2004.10.27 07:25:59 LOG7[5247:16384]: FD 7 in non-blocking mode 2004.10.27 07:25:59 LOG7[5251:16386]: ppp started 2004.10.27 07:25:59 LOG5[5251:16386]: ppp connected from 10.0.0.2:39791 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): before/accept initialization 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: FD=7, DIR=read 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: ok 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 read client hello A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write server hello A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write certificate A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 write server done A 2004.10.27 07:25:59 LOG7[5251:16386]: SSL state (accept): SSLv3 flush data 2004.10.27 07:25:59 LOG7[5251:16386]: waitforsocket: FD=7, DIR=read 2004.10.27 07:26:00 LOG7[5251:16386]: waitforsocket: ok 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 read client key exchange A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 read finished A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 write change cipher spec A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 write finished A 2004.10.27 07:26:00 LOG7[5251:16386]: SSL state (accept): SSLv3 flush data 2004.10.27 07:26:00 LOG7[5251:16386]: 1 items in the session cache 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client connects (SSL_connect()) 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client connects that finished 2004.10.27 07:26:00 LOG7[5251:16386]: 0 client renegotiatations requested 2004.10.27 07:26:00 LOG7[5251:16386]: 1 server connects (SSL_accept()) 2004.10.27 07:26:00 LOG7[5251:16386]: 1 server connects that finished 2004.10.27 07:26:00 LOG7[5251:16386]: 0 server renegotiatiations requested 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache hits 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache misses 2004.10.27 07:26:00 LOG7[5251:16386]: 0 session cache timeouts 2004.10.27 07:26:00 LOG6[5251:16386]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.10.27 07:26:00 LOG7[5251:16386]: pty_allocate:namebuf=, namebuflen=1024 : Success (0) 2004.10.27 07:26:00 LOG3[5251:16386]: openpty: No such file or directory (2) 2004.10.27 07:26:00 LOG3[5251:16386]: Failed to initialize remote connection 2004.10.27 07:26:00 LOG7[5251:16386]: ppp finished (0 left) The log file client side (PC2) is: ---------------------------------- 2004.10.27 07:20:16 LOG5[4460:16384]: stunnel 4.05 on i686-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2004.10.27 07:20:16 LOG7[4460:16384]: RAND_status claims sufficient entropy for the PRNG 2004.10.27 07:20:16 LOG6[4460:16384]: PRNG seeded successfully 2004.10.27 07:20:16 LOG7[4460:16384]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:20:16 LOG7[4460:16384]: Key file: /usr/local/etc/stunnel/stunnel.pem 2004.10.27 07:20:16 LOG7[4460:16384]: stunnel started 2004.10.27 07:20:16 LOG6[4460:16384]: Local mode child started (PID=4461) 2004.10.27 07:20:16 LOG5[4460:16384]: stunnel connected from 127.0.0.1:39790 2004.10.27 07:20:16 LOG7[4460:16384]: FD 4 in non-blocking mode 2004.10.27 07:20:16 LOG7[4460:16384]: stunnel connecting 10.0.0.1:2020 2004.10.27 07:20:16 LOG7[4460:16384]: remote connect #1: EINPROGRESS: retrying 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: FD=4, DIR=write 2004.10.27 07:20:16 LOG3[4461:16384]: /usr/sbin/pppd: No such file or directory (2) 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:16 LOG7[4460:16384]: Remote FD=4 initialized 2004.10.27 07:20:16 LOG7[4460:16384]: SSL state (connect): before/connect initialization 2004.10.27 07:20:16 LOG7[4460:16384]: SSL state (connect): SSLv3 write client hello A 2004.10.27 07:20:16 LOG7[4460:16384]: waitforsocket: FD=4, DIR=read 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server hello A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server certificate A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read server done A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write client key exchange A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 write finished A 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 flush data 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: FD=4, DIR=read 2004.10.27 07:20:17 LOG7[4460:16384]: waitforsocket: ok 2004.10.27 07:20:17 LOG7[4460:16384]: SSL state (connect): SSLv3 read finished A 2004.10.27 07:20:17 LOG7[4460:16384]: 1 items in the session cache 2004.10.27 07:20:17 LOG7[4460:16384]: 1 client connects (SSL_connect()) 2004.10.27 07:20:17 LOG7[4460:16384]: 1 client connects that finished 2004.10.27 07:20:17 LOG7[4460:16384]: 0 client renegotiatations requested 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server connects (SSL_accept()) 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server connects that finished 2004.10.27 07:20:17 LOG7[4460:16384]: 0 server renegotiatiations requested 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache hits 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache misses 2004.10.27 07:20:17 LOG7[4460:16384]: 0 session cache timeouts 2004.10.27 07:20:17 LOG6[4460:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2004.10.27 07:20:17 LOG7[4460:16384]: Socket closed on read 2004.10.27 07:20:17 LOG7[4460:16384]: SSL write shutdown (output buffer empty) 2004.10.27 07:20:17 LOG7[4460:16384]: SSL alert (write): warning: close notify 2004.10.27 07:20:17 LOG7[4460:16384]: SSL_shutdown retrying 2004.10.27 07:20:17 LOG3[4460:16384]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2004.10.27 07:20:17 LOG5[4460:16384]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2004.10.27 07:20:17 LOG7[4460:16384]: stunnel finished (0 left) Any suggestion ? Thanks in advance.. Angelo Raspanti

2 1

Stunnel process die-off halfway
by PinLee_Su＠azuretech.com.sg 25 Oct '04

25 Oct '04

I have downloaded and installed the stunnel-4.05.exe together with the libssl32.dll and libeay32.dll from stunnel.org. I am able to start the stunnel without problem. however after the a while the process die-off automatically. check the event log in the windows (using Windows XP), it gives error msg as "Faulting application stunnel-4-05.exe, version 0.0.0.0, faulting module libssl32.dll, version 0.0.0.0, fault address 0x00006cd8." I would appreciate if anyone can help me on this? many thanks in advance! "Azure Technologies is the IT solutions provider of Hutchison Whampoa Limited and a member of Hutchison Global Communications Holdings Limited." The message is for information purposes only and is not intended to create legally binding relations. The shareholders, directors and management of Azure Technologies and any of its group companies accept no responsibility and accordingly shall have no liability to any party whatsoever with respect to the contents of this message. This message (including any attachments) is intended only for the use of the addressee(s) named above. It may contain information that is PRIVILEGED and CONFIDENTIAL and should not be read, copied or otherwise used by any other person. If you are not the intended recipient, please erase all copies of the message (including attachments) and notify us immediately.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users