stunnel-users

3306 discussions

receive error
by Protect Girl 14 Nov '07

14 Nov '07

Hi When run stunnel.exe, I was receive "the procedure entry point SSL_CTX_xet_info_callback could not be located in the dynamic library libssl32.dll" error.

2 1

can't get client address
by Draeath Spamtrap 14 Nov '07

14 Nov '07

Stunnel appears to be working fine, but when started it spams my syslog about 5 times with the following message: "stunnel: warning: can't get client address: Bad file descriptor" There are no other messages from stunnel. I'm not sure where it's coming from... It looks like it is running without command line arguments. My init script has the following snippets that make me think that: > PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin > PREFIX=/usr/local > DAEMON=/usr/local/bin/stunnel > PIDFILE=/var/lib/stunnel/stunnel.pid > > test -f $DAEMON || exit 0 > > case "$1" in > start) > echo -n "Starting universal SSL tunnel: stunnel" > $DAEMON || echo -n " failed" > echo "." > ;; > {TRIMMED REST OF FILE} My stunnel version info: > stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 > Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP > > Global options > debug = 5 > pid = /usr/local/var/run/stunnel/stunnel.pid > RNDbytes = 64 > RNDfile = /dev/urandom > RNDoverwrite = yes > Service-level options > cert = /usr/local/etc/stunnel/stunnel.pem > ciphers = ALL:!ADH:+RC4:@STRENGTH > key = /usr/local/etc/stunnel/stunnel.pem > session = 300 seconds > sslVersion = SSLv3 for client, all for server > TIMEOUTbusy = 300 seconds > TIMEOUTclose = 60 seconds > TIMEOUTconnect = 10 seconds > TIMEOUTidle = 43200 seconds > verify = none My stunnel config file: > cert = /usr/local/etc/stunnel/stunnel.pem > key = /usr/local/etc/stunnel/stunnel.pem > sslVersion = SSLv3 > chroot = /var/lib/stunnel/ > setuid = 99 > setgid = 99 > pid = /stunnel.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > client = yes > [nntps] > accept = 127.0.0.1:119 > connect = secure.news.easynews.com:563 Again, it is all working, and aside from my TCP_NODELAY flags, everything in my conf would be a show-stopper if it was invalid or not working... *of note: I had to set the uid/gid number. for some reason it couldn't resolve the gid/uid on it's own. My /etc/passwd is world-readable (with hashes in shadow) as is standard. I'm not sure I should even be worried about this...

2 2

Reporting bugs in stunnel 4.21
by Michal Trojnara 10 Nov '07

10 Nov '07

Dear Users, Please test the new stunnel 4.21 and report your issues on the Bug Tracking System (http://stunnel.mirt.net/bts.html) or email the information to the stunnel-users mailing list. This is the easiest way to help stunnel working fine on your various systems. I was developing it for quite a long time and I likely failed to fix all the bugs. I'm especially interested in all compilation or runtime issues with the new FIPS and libwrap code. By the time you can find a patch for setuid/setgid+chroot problem here: ftp://stunnel.mirt.net/stunnel/setuid.patch Best regards, Mike

2 2

How is it working?
by fuzzy_4711 07 Nov '07

07 Nov '07

Hello list. After a few tries, my stunnel configuration is working well. I am using it to tunnel my vnc connections to my winXP box. Now I have a question about how the software is working. In the past, when I was using VNC at port 5900 and I did a telnet to that box with port 5900, VNC was answering with something like 003005 which was the VNC protocol version the server was able to communicate. Now because of the tunneling effect, my vnc server still listens at 127.0.0.1:5900 but is expecting ssled connections at xxx.xxx.xxx.xxx:9999. When I do a telnet at xxx.xxx.xxx.xxx at port 9999 my box is answering something like: Connected to xxx.xxx.xxx.xxx Escape character is ... Now if enter something like "test" the telnet window shows me that the connection is closed by foreign host (means: my xp box). Lets assume, someone is trying to hack my computer and doing a port scan. She/he will find out for sure, that my port 9999 is opened. Usually the server listening behind the port is sending something the attacker could use to point to the software running behind the port. In this case, as far as I can see nothing is sent to give a hint that stunnel is waiting there to route my connection attempt to 127.0.0.1:5900. Is it right, that this is the magic - for sure besides encryption and all the algorithms necessary to do the port forwarding - stunnel provides? I mean as long as an attacker doesnt know what is hiding behind the port he/she also doesnt know how to attack or how to get through. Is that conclusion right? Please tell me, if my conclusions are wrong or if I got something wrong. Stefan

3 2

PATCH: Support PostgreSQL SSL
by Marko Kreen 06 Nov '07

06 Nov '07

PostgreSQL protocol has small handshake on connecting before SSL can be initialized. But that means that Stunnel cannot be used by default as it expects the SSL initialization to be the first thing when getting connection. Attached patch adds PostgreSQL protocol support to Stunnel, so that Stunnel can be used to provide SSL when either client or server is not able to do it natively. SSL handshake is described here: http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73013 Patch is tested and works, hopefully it can be included in main Stunnel source. -- marko

1 0

STUNNEL Licensing
by Menon, Sreejith Mohan 06 Nov '07

06 Nov '07

Dear Users, Is there any special licensing required to use STUNNEL ? In case, it is not required from STUNNEL , is there anything to be done on the OPENSSL side ? Thanks and best regards, Sreejith Mohan Menon

1 0

Re: [stunnel-users] almost working
by Tom Allison 05 Nov '07

05 Nov '07

Luke Deller wrote: > Hi Tom, > >> OK, this has been nothing but a bust. > > I've just read this thread, and it looks to me that you have stunnel configured incorrectly for use with inetd. > > Did you see this documentation? > http://www.stunnel.org/faq/stunnel.html#inetd_mode > >> the error keeps saying that port 993 is already in use. > > This is because you have configured stunnel to bind to port 993 using an "accept" option in the configuration file. When using stunnel with inetd, stunnel should not bind to any port; it is inetd which binds to a port. When a client connects to inetd, then inetd will launch stunnel with stunnel's stdin and stdout streams hooked up to the connected socket. > Made some progress. Got past the SSL version. Fixed my firewall to permit IMAPS sessions. confirmed my firewall settings by changing to IMAP and running directly against the imap server. Changed firewall settings from imap to imaps. Keep timing out. Same problem for Mac Mail application (which isn't great) and Debian's Icedove. This is as far as I can get. 2007.11.05 05:43:56 LOG7[27692:47518144360528]: Connection from 65.29.101.30:49841 permitted by libwrap 2007.11.05 05:43:56 LOG5[27692:47518144360528]: inetd connected from 65.29.101.30:49841 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): before/accept initialization 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 read client hello A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 write server hello A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 write certificate A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 write server done A 2007.11.05 05:43:56 LOG7[27692:47518144360528]: SSL state (accept): SSLv3 flush data

1 0

Re: [stunnel-users] Using stunnel for RDP / Proxy / Firewall
by Frank Garber 30 Oct '07

30 Oct '07

I tried using the port you suggested and got the same result. I'm able to verify my firewall is letting the traffic through and that my ISP is not blocking the port by using www.canyouseeme.org . Again, all my settings work when I'm not going through the corporate firewall. Can you send me your whole config file for both your client and server sides? I'm wondering if it has to do with my certificate settings. Thanks, Frank ----- Original Message ---- From: Carter Browne <xxxx> To: garberfc <xxxx> Sent: Monday, October 22, 2007 8:07:11 AM Subject: Re: [stunnel-users] Using stunnel for RDP / Proxy / Firewall I do this all the time. The way I do it is to connect locally to RDP on a non-stardard port. In the RDP dialog box, I have 127.0.0.10:12121, then in stunnel on the local side is: [xxx-rdp] accept = 127.0.0.10:12121 connect = server:12122 client = yes on the remote side is [rdp-incoming] accept = 12122 connect = 3389 client = no. Normally RDP listens for any connection to port 3389, so I found it was easiest to get to to work by moving off that port. Note that you have to open port 12122 in the firewall on the remote side. On the other hand, you can close 3389 on the remote side which takes away an obvious port for hackers. Carter garberfc wrote: > Hi All > > I'm a relative newbie to Stunnel, and am trying to set up a tunnel so I can > Remote Desktop from work to my PC/server at home. > > I'm using versions 4.20 of the Windows binaries. > > I've tested the configuration and it works from home using a laptop that is > going through my firewall > when I enter my domain home (so my firewall is set up correctly). I tried a > variety of common ports and got the same response every time. I had to use > the 127.0.0.2 on the client because Remote Desktop didn't want me connecting > to myself... > > When I try if from work I get a dialog box: > The client could not establish a connection to the remote computer. > The most likely causes for this error are: > 1) Remote connections might not be enabled at the remote computer. > 2)The maximum number of connections was exceeded at the remote computer. > 3) A network error occurred while establishing the connection. > > My config is as follows: > > #Client > ;cert = stunnel.pem > ;key = stunnel.pem > > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = yes > > ; Service-level configuration > [https-RDT] > accept = 127.0.0.2:3389 > connect = xx.xx.xx.xx:1494 > > > #Server > ; Some performance tunings > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > ; Some debugging stuff useful for troubleshooting > debug = 7 > output = stunnel.log > > ; Use it for client mode > client = no > > ; Service-level configuration > [https-RDT] > accept = 1494 > connect = localhost:3389 > > > Is there something I need to do to traverse this proxy? Any help would be > greatly appreciated! > >

3 4

Re: [stunnel-users] almost working
by Tom Allison 30 Oct '07

30 Oct '07

On Oct 29, 2007, at 9:39 PM, Luke Deller wrote: > > Hi Tom, > >> OK, this has been nothing but a bust. > > I've just read this thread, and it looks to me that you have > stunnel configured incorrectly for use with inetd. > > Did you see this documentation? > http://www.stunnel.org/faq/stunnel.html#inetd_mode > >> the error keeps saying that port 993 is already in use. > > This is because you have configured stunnel to bind to port 993 > using an "accept" option in the configuration file. When using > stunnel with inetd, stunnel should not bind to any port; it is > inetd which binds to a port. When a client connects to inetd, then > inetd will launch stunnel with stunnel's stdin and stdout streams > hooked up to the connected socket. Amazing how much progess can be made in a minute. Thank you very much. I did miss that line in the docs. I've moved on to a slightly different error, but it's probably going to be easier for me to sort this one out. I have to go to out, so I'll read up on it and try it when I get back. I'm going to guess I have a ssl version/imap version issue to sort out. I'm trying to connect from a macbook to this server. Thank You!!! 2007.10.30 07:07:59 LOG5[22402:47915096707152]: stunnel 4.18 on x86_64-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.10.30 07:07:59 LOG5[22402:47915096707152]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.10.30 07:07:59 LOG7[22402:47915096707152]: inetd started 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 0 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 1 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: TCP_NODELAY option set on local socket 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 4 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: FD 5 in non-blocking mode 2007.10.30 07:07:59 LOG7[22402:47915096707152]: Connection from 65.29.101.30:53036 permitted by libwrap 2007.10.30 07:07:59 LOG5[22402:47915096707152]: inetd connected from 65.29.101.30:53036 2007.10.30 07:07:59 LOG7[22402:47915096707152]: SSL state (accept): before/accept initialization 2007.10.30 07:07:59 LOG3[22402:47915096707152]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2007.10.30 07:07:59 LOG5[22402:47915096707152]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.10.30 07:07:59 LOG7[22402:47915096707152]: inetd finished (0 left)

1 0

almost working
by Tom Allison 30 Oct '07

30 Oct '07

I'm trying to tunnel imap but I'm not getting past this: 2007.10.08 05:56:28 LOG5[5355:47656983060560]: stunnel 4.18 on x86_64-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.10.08 05:56:28 LOG5[5355:47656983060560]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.10.08 05:56:28 LOG6[5355:47656983060560]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.10.08 05:56:28 LOG6[5355:47656983060560]: poll() used - no FD_SETSIZE limit for file descriptors 2007.10.08 05:56:28 LOG5[5355:47656983060560]: 500 clients allowed 2007.10.08 05:56:28 LOG7[5355:47656983060560]: FD 4 in non-blocking mode 2007.10.08 05:56:28 LOG7[5355:47656983060560]: FD 5 in non-blocking mode 2007.10.08 05:56:28 LOG7[5355:47656983060560]: FD 6 in non-blocking mode 2007.10.08 05:56:28 LOG7[5355:47656983060560]: SO_REUSEADDR option set on accept socket 2007.10.08 05:56:28 LOG3[5355:47656983060560]: Error binding imaps to 0.0.0.0:993 2007.10.08 05:56:28 LOG3[5355:47656983060560]: bind: Address already in use (98) I can't find where to begin. I set SO_REUSEADDR and it didn't do anything different. How do I test this stuff sanely?

4 8

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users