stunnel-users

2 participants
3307 discussions

webmail compose page get expire and logout
by jayesh.shinde 08 Aug '11

08 Aug '11

Dear All , I am trying to setup a load balancing under webmail on my test servers. Here is my setup details :-- Total server are 3 servers. i.e ( 2 backend webmail server and 1 front server ) On one server I have installed haproxy-1.4.15.tar.gz + stunnel-4.41.tar.gz with http:// and https:// Another two servers are installed with squirrelmail . my problem:-- ========== 1) When I access the webmail by https://webmail.domain.com and compose any email and click on send button , the page is getting expire and I am getting log out from webmail. In Firefox there is no error on browser , where as in internet explorer I am getting below error with popup window :-- *Error Popup* :-- ============ "do you want to view only the webpage content that was deliver securely. This webpage contain the content that will not be delivered using the secure HTTPS connection, which could compromise the security of entire webpage." Where as if I check with http://webmail.domain.com , then the mail compose and send work properly. Here is the stunnel.conf :-- =================== [root@jayesh ~]# cat /etc/stunnel/stunnel.conf cert=/opt/ssl/ssl.key/mail_domain_com.crt key=/opt/ssl/ssl.key/domain.key setuid=stunnel setgid=stunnel pid=/var/run/stunnel/stunnel.pid output = /var/log/stunnel.log debug = 7 socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=192.168.30.200:443 connect=192.168.30.200:81 TIMEOUTclose = 0 session = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 600 I checked by defining the TIMEOUTs but I am not able to figure out why the page is getting expire and I am getting logout ? There is firewall rule between any servers. Please suggest me and guide on this issue. I am stuck here. Regards Jayesh Shinde

1 0

anyone got a port for android?
by Jason Haar 05 Aug '11

05 Aug '11

Hi there Exchange email doesn't work on Android for us because we have a requirement for using client certs to protect the ActiveSync over HTTPS transactions. If I had stunnel, I could sync with localhost and stunnel could do the client cert-foo.... So does anyone know of a working stunnel implementation for Android (or even something else that does the same job?) Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 2

FreeBSD upgrading to 4.41 (Dispatching signals from the signal pipe)
by Nicolas de Bari Embriz Garcia Rojas 04 Aug '11

04 Aug '11

Hi, I just upgrade stunner on a FreeBSD server from 4.35 to 4.41 using the ports, I restarted the server and notice that stunnel was not listen to any port, I had to manually restart it so it could work again. I increased the debug to 7 and got this when booting: 2011.08.04 17:44:58 LOG7[1123:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:44:58 LOG5[1123:675287360]: Received signal 15; terminating 2011.08.04 17:44:58 LOG7[1123:675287360]: str_stats: 0 block(s), 0 byte(s) 2011.08.04 17:44:58 LOG7[1123:675287360]: removing pid file /stunnel.pid 2011.08.04 17:45:29 LOG7[682:675287360]: No limit detected for the number of clients 2011.08.04 17:45:29 LOG7[682:675287360]: signal_pipe: FD=3 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: signal_pipe: FD=4 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG5[682:675287360]: stunnel 4.41 on i386-portbld-freebsd8.2 platform 2011.08.04 17:45:29 LOG5[682:675287360]: Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 2011.08.04 17:45:29 LOG5[682:675287360]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv4 2011.08.04 17:45:29 LOG5[682:675287360]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2011.08.04 17:45:29 LOG7[682:675287360]: PRNG seeded successfully 2011.08.04 17:45:29 LOG6[682:675287360]: Initializing SSL context for service ssmtp 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Key file: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Private key loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Could not load DH parameters from /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Using hardcoded DH parameters 2011.08.04 17:45:29 LOG7[682:675287360]: DH initialized with 2048-bit key 2011.08.04 17:45:29 LOG7[682:675287360]: ECDH initialized with curve prime256v1 2011.08.04 17:45:29 LOG7[682:675287360]: SSL options set: 0x00000004 2011.08.04 17:45:29 LOG6[682:675287360]: SSL context initialized 2011.08.04 17:45:29 LOG6[682:675287360]: Initializing SSL context for service ssmtp2 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Certificate loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Key file: /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Private key loaded 2011.08.04 17:45:29 LOG7[682:675287360]: Could not load DH parameters from /usr/local/etc/stunnel/smtp.inbox.pem 2011.08.04 17:45:29 LOG7[682:675287360]: Using hardcoded DH parameters 2011.08.04 17:45:29 LOG7[682:675287360]: DH initialized with 2048-bit key 2011.08.04 17:45:29 LOG7[682:675287360]: ECDH initialized with curve prime256v1 2011.08.04 17:45:29 LOG7[682:675287360]: SSL options set: 0x00000004 2011.08.04 17:45:29 LOG6[682:675287360]: SSL context initialized 2011.08.04 17:45:29 LOG5[682:675287360]: Configuration successful 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=5 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=6 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=6 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=7 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=7 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=8 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=8 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=9 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=9 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: libwrap_init: FD=10 allocated (blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: accept socket: FD=11 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: Option SO_REUSEADDR set on accept socket 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp bound to 0.0.0.0:465 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp opened FD=11 2011.08.04 17:45:29 LOG7[682:675287360]: accept socket: FD=12 allocated (non-blocking mode) 2011.08.04 17:45:29 LOG7[682:675287360]: Option SO_REUSEADDR set on accept socket 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp2 bound to 0.0.0.0:587 2011.08.04 17:45:29 LOG7[682:675287360]: Service ssmtp2 opened FD=12 2011.08.04 17:45:29 LOG7[688:675287360]: Created pid file /stunnel.pid 2011.08.04 17:45:42 LOG7[688:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp closed FD=11 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp2 closed FD=12 This is my conf: cert = /usr/local/etc/stunnel/smtp.inbox.pem chroot = /usr/local/var/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid debug = 7 output = /stunnel.log client = no foreground = no ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [ssmtp] accept = 465 connect = 25 [ssmtp2] accept = 587 connect = 25 Any ideas of what could it be wrong? the last 2 lines of the boot log tell me that the ports i specify are been closed but why? 2011.08.04 17:45:42 LOG7[688:675287360]: Dispatching signals from the signal pipe 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp closed FD=11 2011.08.04 17:45:42 LOG7[688:675287360]: Service ssmtp2 closed FD=12 thanks in advance. regards

2 1

(no subject)
by Nicolas de Bari Embriz Garcia Rojas 04 Aug '11

04 Aug '11

1 0

STunnel NTLM Proxy problem
by Subhash Sharma 04 Aug '11

04 Aug '11

Has anyone use Stunnel to works with NTLM proxy? I am using Stunnel 4.35 on window It works fine straught and basic proxy but fails to use NTLM proxy. My config for NTLM is like this ---------------- configuration --------------------- [https] accept = someport connect = proxy:proxy_port protocol = connect protocolAuthentication = NTLM protocolHost = dest:dest_port protocolUsername = domain\username protocolPassword = password ----------------------------------------------------- I checked the traffic using the win shark -----------------win shark for stunnel ----------------- CONNECT dest:destport HTTP/1.1 , NTLMSSP_AUTH, User: \domain\username Proxy-Authorization: NTLM some long string NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_AUTH (0x00000003) Lan Manager Response: Empty NTLM Response: 951842e95a3e1a0001d8ac6fb2980a004b82ffa75232795d … Domain name: NULL User name: domain\username … ------------------------------------------------------ STunnel is not sending the domain and sends the user name consisting of domain and username. When IE is configured to use NLM proxy, traffic is as -------------- win shark for IE ----------------------------- CONNECT dest:destport HTTP/1.1 , NTLMSSP_AUTH, User: domain\username Proxy-Authorization: NTLM some long string NTLM Secure Service Provider NTLMSSP identifier: NTLMSSP NTLM Message Type: NTLMSSP_AUTH (0x00000003) Lan Manager Response: 10f2d8147a2651de00000000000000000000000000000000 … NTLM Response: 951842e95a3e1a0001d8ac6fb2980a004b82ffa75232795d … Domain name: domain … User name: username .. Host name: host -------------------------------------------------------------- ---- stunnel log --------------- 2011.08.04 10:11:16 LOG7[2384:5480]: Service https started 2011.08.04 10:11:16 LOG7[2384:5480]: Option TCP_NODELAY set on local socket 2011.08.04 10:11:16 LOG5[2384:5480]: Service https accepted connection from 127.0.0.1:9913 2011.08.04 10:11:16 LOG7[2384:5480]: remote socket: FD=1456 allocated (non-blocking mode) 2011.08.04 10:11:16 LOG6[2384:5480]: connect_blocking: connecting 172.23.11.161:8080 2011.08.04 10:11:16 LOG7[2384:5480]: connect_blocking: s_poll_wait 172.23.11.161:8080: waiting 10 seconds 2011.08.04 10:11:16 LOG5[2384:5480]: connect_blocking: connected 172.23.11.161:8080 2011.08.04 10:11:16 LOG5[2384:5480]: Service https connected remote server from 172.23.11.45:9914 2011.08.04 10:11:16 LOG7[2384:5480]: Remote FD=1456 initialized 2011.08.04 10:11:16 LOG7[2384:5480]: Option TCP_NODELAY set on remote socket 2011.08.04 10:11:16 LOG5[2384:5480]: Negotiations for connect (client side) started 2011.08.04 10:11:16 LOG7[2384:5480]: -> CONNECT 172.23.11.35:443 HTTP/1.1 2011.08.04 10:11:16 LOG7[2384:5480]: -> Host: 172.23.11.35:443 2011.08.04 10:11:16 LOG7[2384:5480]: -> Proxy-Connection: keep-alive 2011.08.04 10:11:16 LOG7[2384:5480]: -> Proxy-Authorization: NTLM TlRMTVNTUAABAAAAAgIAAA== 2011.08.04 10:11:16 LOG7[2384:5480]: -> 2011.08.04 10:11:16 LOG7[2384:5480]: <- HTTP/1.1 407 Proxy Authentication Required 2011.08.04 10:11:16 LOG7[2384:5480]: <- Server: FreeProxy/4.50 2011.08.04 10:11:16 LOG7[2384:5480]: <- Date: Thu, 04 Aug 2011 17:11:16 GMT 2011.08.04 10:11:16 LOG7[2384:5480]: <- Content-Type: text/html 2011.08.04 10:11:16 LOG7[2384:5480]: <- Transfer-Encoding: Chunked 2011.08.04 10:11:16 LOG7[2384:5480]: <- Proxy-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAADgAAAACAgACATR6TVahgFIAAAAAAAAAAAAAAAA4AAAABQLODgAAAA8= 2011.08.04 10:11:16 LOG7[2384:5480]: <- Proxy-Connection: Keep-Alive 2011.08.04 10:11:16 LOG7[2384:5480]: <- 2011.08.04 10:11:16 LOG7[2384:5480]: -> CONNECT 172.23.11.35:443 HTTP/1.1 2011.08.04 10:11:16 LOG7[2384:5480]: -> Host: 172.23.11.35:443 2011.08.04 10:11:16 LOG7[2384:5480]: -> Proxy-Authorization: NTLM TlRMTVNTUAADAAAAAAAAAGwAAAAYABgAQAAAAAAAAABsAAAAFAAUAFgAA......1jDUOrcoBBus0aPbH44onfcpGZvdW5kc3RvbmVccHN5cy1udGxt 2011.08.04 10:11:16 LOG7[2384:5480]: -> 2011.08.04 10:11:16 LOG7[2384:5480]: <- 7E5 2011.08.04 10:11:16 LOG3[2384:5480]: CONNECT request rejected 2011.08.04 10:11:16 LOG7[2384:5480]: <- <html> 2011.08.04 10:11:16 LOG7[2384:5480]: <- 2011.08.04 10:11:16 LOG5[2384:5480]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.04 10:11:16 LOG7[2384:5480]: Service https finished (0 left) 2011.08.04 10:11:16 LOG7[2384:5480]: str_stats: 0 block(s), 0 byte(s) -------------------------------- Please help!!! Subhash Sharma

1 0

silent install of windows stunnel
by Laurent Licour 04 Aug '11

04 Aug '11

stunnel use NSIS as installer and it is possible to use /S switch to run silent install However, even in this mode, openssl configuration tools is executed and prompt for certificate informations. I think that executign this tools should be skip in silent mode -- Laurent LICOUR

2 2

stunnel OK without "transparent = source", with = timeout problem
by Elodie BOSSIER 03 Aug '11

03 Aug '11

Greetings again, Thanks so much to have updated the manual about SNI, my stunel works correctly. But i have a tiny problem, when i visit my webserver, the SERVER['REMOTE_ADDR'] with PHP isn't the ip adress of the visitor but the IP of the stunnel. I have read the manual about this transparent proxy and i don't sucess with the configuration. This is my config file : pid = /stunnel.pid options = NO_SSLv2 transparent = source [virtual] accept = 443 cert = /usr/local/openssl/etc/CERTIFICATES/www.franceserv.fr_cert.cert key = /usr/local/openssl/etc/PRIVATE_KEYS/www.franceserv.fr_key.pem connect = www.franceserv.fr:80 [sni1] sni = virtual:elodie.franceserv.com cert = /etc/ssl-fsh/cert-elodie.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = elodie.franceserv.com:80 [sni2] sni = virtual:befun.franceserv.com cert = /etc/ssl-fsh/cert-befun.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = befun.franceserv.com:80 It's don't work, i have a timeout with my browser. With iptables, i have set this : iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward My stunnel is on the server 192.168.0.20 and the webserver on 192.168.0.2 I try to follow the help of http://www.stunnel.org/static/stunnel.html#service_level_options with : transparent = none | source | destination | both (Unix only) Could you tell me what i make wrong please ?

2 4

Failed to run 2 instances of windows service (error 1053)
by Laurent Licour 03 Aug '11

03 Aug '11

I have to run at the same time on the same windows host, 2 instances of stunnel : a client instance and a server instance I have 2 config files : stunnel-client.conf , stunnel-server.conf Each configuration works, but not at the same time. I can install 2 services (with differents service name), but i can't start both services at the same time. I have to stop the first one to start the second one stunnel.exe -install stunnel-client.conf stunnel.exe -install stunnel-server.conf stunnel.exe -start stunnel-client.conf stunnel.exe -start stunnel-server.conf --> error 1053 stunnel.exe -stop stunnel-client.conf stunnel.exe -start stunnel-server.conf stunnel.exe -start stunnel-client.conf --> error 1053 It is also not possible to start the both configurations directly (no service mode). test run with stunnel 4.42b2 on windows XPe and Win2008R2 -- Laurent LICOUR

2 1

Failed to run 2 instances of windows service (error 1053)
by Laurent Licour 01 Aug '11

01 Aug '11

1 0

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users