- stunnel-users - stunnel.org

Re: [stunnel-users] stunnel-users Digest, Vol 34, Issue 4
by GNUtoo＠no-log.org 15 May '07

15 May '07

>> in cygwin i have the following errors: >> $ openssl req -new -x509 -days 365 -nodes -config >> /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem >> Generating a 512 bit RSA private key >> ..++++++++++++ >> .....++++++++++++ >> writing new private key to 'stunnel.pem' >> ----- >> unable to find 'distinguished_name' in config >> problems making Certificate Request >> 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no >> value:conf_lib.c:329:group=req name=distinguished_name >> >> $ /usr/bin/stunnel.exe >> 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on >> /etc/stunnel/mail.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: >> /etc/stunnel/stunnel.pem >> 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : >> error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib >> 2007.05.13 22:37:12 LOG3[2188:6422536]: >> SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM >> routines:PEM_read_bio:no start line >> >> and i ran all as Administrator > > Can you please post your /etc/stunnel/stunnel.conf, and also the results > of > 'ls -al /etc/stunnel'. Thanks, Andrew. > $ ls -al /etc/stunnel/ total 6 drwx------+ 2 FC1 Users 0 May 13 22:37 . drwx------+ 11 FC1 Users 0 May 13 21:56 .. lrwxrwxrwx 1 Administrator Nessuno 11 May 13 22:37 mail.pem -> stunnel.pem -rwx------ 1 Administrator Nessuno 1578 May 13 22:36 stunnel.conf -rwx------+ 1 FC1 Users 1533 May 13 22:13 stunnel.conf-sample -rw-r--r-- 1 Administrator Nessuno 497 May 13 22:36 stunnel.pem $ cat /etc/stunnel/stunnel.conf #; Sample stunnel configuration file by Michal Trojnara 2002-2006 #; Some options used here may not be adequate for your particular configuration #; Please make sure you understand them (especially the effect of chroot jail) #; Certificate/key is needed in server mode and optional in client mode #;cert = /etc/stunnel/mail.pem key = /etc/stunnel/mail.pem #; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 #; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel/ setuid = nobody setgid = nobody #; PID is created inside chroot jail pid = /stunnel.pid #; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #;compression = rle #; Workaround for Eudora bug #;options = DONT_INSERT_EMPTY_FRAGMENTS #; Authentication stuff #;verify = 2 #; Don't forget to c_rehash CApath #; CApath is located inside chroot jail #;CApath = /certs #; It's often easier to use CAfile #;CAfile = /etc/stunnel/certs.pem #; Don't forget to c_rehash CRLpath #; CRLpath is located inside chroot jail #;CRLpath = /crls #; Alternatively you can use CRLfile #;CRLfile = /etc/stunnel/crls.pem #; Some debugging stuff useful for troubleshooting #;debug = 7 #;output = stunnel.log #; Use it for client mode #;client = yes #; Service-level configuration #;[pop3s] #;accept = 995 #;connect = 110 #;[imaps] #;accept = 993 #;connect = 143 #;[ssmtp] #;accept = 465 #;connect = 25 #;[https] ##;accept = 443 #;connect = 80 #;TIMEOUTclose = 0 #; vim:ft=dosini [vnc] accept = 127.0.0.1:5500 connect = 192.168.1.107:443

1 0

certs problems in cygwin
by GNUtoo＠no-log.org 14 May '07

14 May '07

in cygwin i have the following errors: $ openssl req -new -x509 -days 365 -nodes -config /etc/stunnel/stunnel.conf -out stunnel.pem -keyout stunnel.pem Generating a 512 bit RSA private key ..++++++++++++ .....++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1988:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=req name=distinguished_name $ /usr/bin/stunnel.exe 2007.05.13 22:37:12 LOG4[2188:6422536]: Wrong permissions on /etc/stunnel/mail.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: Error reading certificate file: /etc/stunnel/stunnel.pem 2007.05.13 22:37:12 LOG3[2188:6422536]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 22:37:12 LOG3[2188:6422536]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line and i ran all as Administrator

2 1

with the windows version it isn't better...same kind of errors
by GNUtoo＠no-log.org 13 May '07

13 May '07

C:\Programmi\openssl>openssl.exe req -new -x509 -days 365 -nodes -config stunnel .conf -out stunnel.pem -keyout stunnel.pem Loading 'screen' into random state - done Generating a 512 bit RSA private key .....++++++++++++ .......................++++++++++++ writing new private key to 'stunnel.pem' ----- unable to find 'distinguished_name' in config problems making Certificate Request 1772:error:0E06D06C:configuration file routines:NCONF_get_string:no value:./cryp to/conf/conf_lib.c:329:group=req name=distinguished_name 2007.05.13 23:05:03 LOG3[304:860]: Error resolving 'VNC_client_IP_address': Neither nodename nor servname known (EAI_NONAME) Cannot resolve 'VNC_client_IP_address:443' - delaying DNS lookup 2007.05.13 23:05:03 LOG3[304:860]: Error reading certificate file: stunnel.pem 2007.05.13 23:05:03 LOG3[304:860]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2007.05.13 23:05:03 LOG3[304:860]: SSL_CTX_use_certificate_chain_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2007.05.13 23:05:03 LOG3[304:860]: Server is down

1 0

RTMPS
by Grant Kohler 11 May '07

11 May '07

Has anybody had any luck getting RTMP and stunnel to work together with RTMPS? Thanks, -Grant

1 0

Stunnel-Mozilla Thunderbird 2.0 and Spampal
by Jim 30 Apr '07

30 Apr '07

2 1

RE: [stunnel-users] Vista not connecting to port 139
by Neil Aggarwal 29 Apr '07

29 Apr '07

Alaric: This is strange. When I go to the Security Center, it says the McAfee Personal Firewall is on, but I can't find it in the Start menu, Services, or anywhere else. Any ideas? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. -----Original Message----- From: Alaric Dailey [mailto:[email protected]] Sent: Thursday, April 26, 2007 3:48 PM To: 'Neil Aggarwal' Subject: RE: [stunnel-users] Vista not connecting to port 139 I would check the windows firewall, or any other security suite you may have. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Neil Aggarwal Sent: Thursday, April 26, 2007 15:30 To: stunnel-users(a)mirt.net Subject: [stunnel-users] Vista not connecting to port 139 Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details. _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Handshake failure
by RUTSCHLE Yves 27 Apr '07

27 Apr '07

RUTSCHLE Yves wrote: > Argh. After removing all my debugging printf's, it turns out it doesn't seem > to work after all. Which, if it has to do with signals and timing, is only > partly surprising. Ok, nothing to do with any of that. Deep inside OpenSSL, there is a call to gmtime_r. Deep somewhere in hell (I hope), someone decided that LynxOS' gmtime_r functions would have its arguments *reversed*. REVERSED. I guess they were going for SIXPO complience. So that call would write rubbish in the stack, hence no returning from the call and segfault instead. So, nothing to do with stunnel after all. Thanks for the support anyway! :) Y. - TGIFriday

1 0

[PATCH?] Senting a list of accepted CAs to the client
by Miloslav Trmac 27 Apr '07

27 Apr '07

Hello, stunnel currently does not send a list of accepted CAs, see e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=327001#c20 . Sending the list was #if 0-ed out sometime between stunnel 3.22 and 4.00, with no change log entry AFAICS. Does anyone remember know why was it disabled, and whether it is safe to reenable (e. g. using the attached patch)? Thanks, Mirek

1 0

Vista not connecting to port 139
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: I am trying to map a network drive over an stunnel connection. The server is Linux and the client machine is Windows Vista (Ugh!). I have stunnel installed and working. I have the following in my stunnel.conf: client = yes delay = yes [netDrives] accept = 222.222.222.222:139 connect = www.jammconsulting.com:2139 When I go to map the network drive on vista, I use this command: net use x: \\222.222.222.222\MyShare mypass /user:myuser It eventually gives me an error message about network path not found. Looking at the stunnel window, there are no messages about any connections to the stunnel. If I do: telnet 222.222.222.222 139 the telnet session connects and I see messages about a connection in the stunnel window. Any ideas why Vista is not using port 139? Thanks, Neil -- Neil Aggarwal, (832)245-7314, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

1 0

Stunnel on Vista
by Neil Aggarwal 26 Apr '07

26 Apr '07

Hello: Has anyone used stunnel on Vista? For some stupid reason, it tells me I can't save the stunnel.conf file. Thanks, Neil -- Neil Aggarwal, (214)986-3533, www.JAMMConsulting.com FREE! Eliminate junk email and reclaim your inbox. Visit http://www.spammilter.com for details.

2 2