- stunnel-users - stunnel.org

using an ocsp
by Samuel Landau 26 Mar '07

26 Mar '07

Hello, I am using stunnel 4.18 and openca-ocspd 1.5.1. The OCSPd uses a delegate certificate and the setup works when tested with openssl: $ openssl ocsp -issuer /home/landau/ssl/cacert.pem -serial 3 -url http://localhost:2560 -CAfile /home/landau/ssl/cacert.pem Response verify OK 3: good This Update: Mar 23 18:27:37 2007 GMT Next Update: Mar 26 10:56:33 2007 GMT But when it comes to using stunnel, I cannot figure out how to make it use properly the OCSP. I could see that stunnel 4.19 had more options for ocsp, but I am unsure this is related to my current issue. Besides, is there a way to have stunnel fall back on local cert/crl files if the ocsp server is not available ? Regards, -- Samuel Landau ____________________________________________________________________________ This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited. E-mail messages are not necessarily secure. Archos does not accept responsibility for any changes made to this message after it was sent. 2007.03.26 12:59:05 LOG5[29250:3083020512]: stunnel 4.18 on i486-pc-linux-gnu with OpenSSL 0.9.8c 05 Sep 2006 2007.03.26 12:59:05 LOG5[29250:3083020512]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2007.03.26 12:59:05 LOG6[29250:3083020512]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.26 12:59:05 LOG6[29250:3083020512]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.26 12:59:05 LOG5[29250:3083020512]: 500 clients allowed 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 4 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 5 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: FD 6 in non-blocking mode 2007.03.26 12:59:05 LOG7[29250:3083020512]: SO_REUSEADDR option set on accept socket 2007.03.26 12:59:05 LOG7[29250:3083020512]: server bound to 127.0.0.1:12345 2007.03.26 12:59:05 LOG7[29250:3083020512]: Created pid file /home/landau/stunnel4.pid 2007.03.26 12:59:12 LOG7[29250:3083020512]: server accepted FD=7 from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: server started 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 7 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: TCP_NODELAY option set on local socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 9 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3083020512]: Cleaning up the signal pipe 2007.03.26 12:59:12 LOG6[29250:3083020512]: Child process 29252 finished with code 0 2007.03.26 12:59:12 LOG7[29250:3082972080]: Connection from 127.0.0.1:36200 permitted by libwrap 2007.03.26 12:59:12 LOG5[29250:3082972080]: server connected from 127.0.0.1:36200 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): before/accept initialization 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 read client hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write server hello A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 write certificate request A 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL state (accept): SSLv3 flush data 2007.03.26 12:59:12 LOG6[29250:3082972080]: *** starting OCSP verification *** 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: waiting 10 seconds 2007.03.26 12:59:12 LOG7[29250:3082972080]: connect_wait: connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: OCSP server connected 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in blocking mode 2007.03.26 12:59:12 LOG7[29250:3082972080]: FD 8 in non-blocking mode 2007.03.26 12:59:12 LOG6[29250:3082972080]: OCSP response received 2007.03.26 12:59:12 LOG3[29250:3082972080]: OCSP_basic_verify: 27069076: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found 2007.03.26 12:59:12 LOG7[29250:3082972080]: SSL alert (write): fatal: certificate unknown 2007.03.26 12:59:12 LOG3[29250:3082972080]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2007.03.26 12:59:12 LOG5[29250:3082972080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.26 12:59:12 LOG7[29250:3082972080]: server finished (0 left) 2007.03.26 12:59:16 LOG3[29250:3083020512]: Received signal 2; terminating 2007.03.26 12:59:16 LOG7[29250:3083020512]: removing pid file /home/landau/stunnel4.pid cert = landau.pem key = landau.key sslVersion = SSLv3 pid =/home/landau/ssl/stunnel4.pid socket =l:TCP_NODELAY=1 socket =r:TCP_NODELAY=1 compression =zlib foreground =yes verify =3 CApath =/home/landau/ssl/ CAfile =/home/landau/ssl/cacert.pem debug =7 output =/home/landau/ssl/stunnel4.log client =no [server] accept =localhost:12345 ocsp =http://localhost:2560 pty =no exec =/bin/bash execargs =bash

1 0

[win32] stunnel/OpenSSL/Synergy howto
by P. Jansen 25 Mar '07

25 Mar '07

Hi stunnel users and especially newbies, on http://stunnel.mirt.net/docs.html you can find a link to a stunnel/OpenSSL/Synergy howto for the Win32 platform. It is a short but hopefully useful doc how to install, configure and use stunnel. Feedback and comments are welcome. - Patrick

1 0

Solaris 10 and MySQL questions
by mdpeters 25 Mar '07

25 Mar '07

My goal is to have a web server transfer MySQL data via an AES tunnel to a MySQL database server with an added encryption card. Both systems have the same SSL and Stunnel software installed. My web servers database seems to be functioning as normal. I would like to verify that what I have is complete and effective. It is not apparent to me if I have finished construction or how to verify this works like I want it to. I'm not sure how I would verify that Stunnel is being used. Do I need to run Stunnel as a background service full time? Is there something I am missing here? ++++++ # /usr/local/sbin/stunnel -version stunnel 4.20 on sparc-sun-solaris2.10 with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.10/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.3.2 # uname -a SunOS slinky 5.10 Generic_118833-17 sun4u sparc SUNW,Ultra-80 # /usr/local/sbin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 65535 SO_SNDBUF -- -- -- 65535 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- -- SO_SNDTIMEO -- -- -- -- SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 # openssl ciphers -v DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 IDEA-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=IDEA(128) Mac=MD5 RC2-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 DES-CBC-MD5 SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC2-CBC-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export ++++++

1 0

How to surf the web over proxy?
by P. Jansen 25 Mar '07

25 Mar '07

Hi, I know there is a way to do the following with SSH+PuTTY, with stunnel too? Do I need further software? Windows office computer --> (HTTP) --> Corporate firewall/proxy --> (HTTP) --> Home computer --> WWW Regards, Patrick

1 0

Stunnel 4.20 with TCP Wrappers 7.6 problem in configure.ac
by lists＠d-ra.ath.cx 18 Mar '07

18 Mar '07

Hi, the following patch makes stunnel 4.20 to operate with TCP wrappers 7.6. I had not tried other versions of stunnel nor TCP wrappers. The problem is the missing libnsl, so TCP wrappers will never be activated in ./configure Regards Dieter --- configure.ac.orig 2007-03-17 12:57:32.000000000 +0100 +++ configure.ac 2007-03-17 12:55:19.000000000 +0100 @@ -310,7 +310,7 @@ AC_MSG_RESULT([no (autodetecting)]) AC_MSG_CHECKING([for hosts_access in -lwrap]) saved_LIBS="$LIBS" - LIBS="$saved_LIBS -lwrap" + LIBS="$saved_LIBS -lwrap -lnsl" AC_LINK_IFELSE( [AC_LANG_PROGRAM( [[int hosts_access(); int allow_severity, deny_severity;]],

2 9

Getting a "Peer suddenly disconnected" error
by David Goodwin 09 Mar '07

09 Mar '07

Hey all, I'm getting this in the /var/adm/messages log on the server side when attempting to connect from the client: Mar 8 22:23:33 SERVERNAME stunnel: [ID 821868 daemon.error] LOG3[27429:4]: SSL_connect: Peer suddenly disconnected I have the server configured as follows: cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/stunnel.pem [sunrpc] accept=112 connect=127.0.0.1:111 TIMEOUTclose=10 This is started just by running stunnel with the config file and then starting rpcbind normally. The client is configured as follows: # cat /etc/stunnel/stunnel.test.conf client=yes debug=debug cert=/etc/stunnel/imnxnsm0.pem [sunrpc] accept=111 connect=SERVERNAME:112 The error shows up when I attempt to run "rpcinfo -p 127.0.0.1". Snoop is showing the following (adjusted to remove hostnames/ips): CLIENT -> SERVER TCP D=112 S=63986 Syn Seq=867918817 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> SERVER -> CLIENT TCP D=63986 S=112 Syn Ack=867918818 Seq=209756753 Len=0 Win=24820 Options=<nop,nop,sackOK,mss 1460> CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=0 Win=24820 CLIENT -> SERVER TCP D=112 S=63986 Ack=209756754 Seq=867918818 Len=88 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Ack=867918906 Seq=209756754 Len=0 Win=24820 SERVER -> CLIENT TCP D=63986 S=112 Rst Seq=209756754 Len=0 Win=24820 I'm pretty new to stunnel, and am having a heck of a time getting this to work. This configuration is the closest I've been to success so far. Is there a better way for me to wrap rpcbind perhaps? Any help with this will be appreciated. Thanks, Civil

2 2

DLLs for OpenSSL 0.9.8e
by Michal Trojnara 09 Mar '07

09 Mar '07

Dear Users, I've built the DLLs for OpenSSL 0.9.8e. They're available for download from: ftp://stunnel.mirt.net/openssl/binary-0.9.8e-zdll/ Best regards, Mike

1 0

problem accesing a https site as a Windows version client
by Gustavo 09 Mar '07

09 Mar '07

I'm running stunnel version 4.2 on Windows XP I can access a lot of websites, example https://servicios.afip.gov.ar/tramites_con_clave_fiscal/misAportes/images/t… but CAN'T access https://apwebserver.rentasgcba.gov.ar/ablpatib_ssl/images/Actitud_BsAs_negr… apparently a response never arrives to my PC my conf file is cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes ; Service-level configuration [https1] client = yes accept = 6001 connect = servicios.afip.gov.ar:443 TIMEOUTclose = 0 [https] client = yes accept = 6002 connect = apwebserver.rentasgcba.gov.ar:443 TIMEOUTclose = 5 ; vim:ft=dosini

2 1

Download speed affected with stunnel help needed please.
by tom hammond 07 Mar '07

07 Mar '07

Using HFS 2.1d http://www.rejetto.com and Stunnel 4.20 on single WinXP machine. The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = # connect = # TIMOUTclose = 0 I dont'understand 3-7 as given here: http://www.stunnel.org/support/ only used OpenSSL to make CERT Win32 OpenSSL v0.9.8e Light *************************************** Description: HFS is a webserver that can only utilize HTTP, therefore I turned to Stunnel to implement https. When using HTTPs: for UPLOADING I get full speed. When using HTTPs: for DOWNLoADING the speed in cut drastically, 20x slower. The odd thing is, multiple downloads can go at once eg: 20 connections @80kb/second However no single connection will get over 80 or 100kb/second I searched the net and couldn't find a solution, but continuously came across mention of "loopback" problems with stunnel and http servers (old posts) or saying stuff about Microsoft winsock, found a few mentions of VNC server having an option to "enable loopback connections" Another thing I saw but closed (oops) was mention of disabling an HTTP server in order to avoid loopback problems with HTTPS serving.(HFS has no option because it is designed to serve ONLY HTTP) I have tons of hope for an easy solution for the following reasons: #1, uploading works perfect #2 just downloaded demo of Easy File Sharing Web Server(not free like HFS) and the download speed works through HTTPS. I have no clue as to how to fix this, saw one entry in the stunnel config at ssl.org: socket = a:SO_BINDTODEVICE=lo I DID attempt to enter this line into the config under my 2 original entries, but then stunnel would not start. Thank you --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

1 0

init_ssl: s_poll_wait timeout
by William Biagi 06 Mar '07

06 Mar '07

I am using a Eudora client configured to use STARTLS to send mail through stunnel to a sendmail server. The stunnel config is as follows: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = DONT_INSERT_EMPTY_FRAGMENTS delay = yes TIMEOUTconnect = 300 TIMEOUTbusy = 300 setuid = smtpauth setgid = smtpauth debug = 7 client = no foreground = yes pid = [smtps] accept = 465 connect = localhost:25 protocol=smtp When I send mail the connection is established with port 465 on stunnel but it fails to negotiate the ssl session. THis is the log: 2007.03.06 15:45:08 LOG7[17753:1024]: Snagged 64 random bytes from /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: Wrote 1024 new random bytes to /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: RAND_status claims sufficient entropy for the PRNG 2007.03.06 15:45:08 LOG7[17753:1024]: PRNG seeded successfully 2007.03.06 15:45:08 LOG7[17753:1024]: Configuration SSL options: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: SSL options set: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate loaded 2007.03.06 15:45:08 LOG7[17753:1024]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Private key loaded 2007.03.06 15:45:08 LOG7[17753:1024]: SSL context initialized for service smtps 2007.03.06 15:45:08 LOG5[17753:1024]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.7l 28 Sep 2006 2007.03.06 15:45:08 LOG5[17753:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 2007.03.06 15:45:08 LOG6[17753:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.06 15:45:08 LOG6[17753:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.06 15:45:08 LOG5[17753:1024]: 500 clients allowed 2007.03.06 15:45:08 LOG7[17753:1024]: FD 3 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 4 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 5 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: SO_REUSEADDR option set on accept socket 2007.03.06 15:45:08 LOG7[17753:1024]: smtps bound to 0.0.0.0:465 2007.03.06 15:45:08 LOG7[17753:1024]: No pid file being created 2007.03.06 15:45:18 LOG7[17753:1024]: smtps accepted FD=6 from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: smtps started 2007.03.06 15:45:18 LOG7[17755:1026]: FD 6 in non-blocking mode 2007.03.06 15:45:18 LOG7[17755:1026]: TCP_NODELAY option set on local socket 2007.03.06 15:45:18 LOG5[17755:1026]: smtps accepted connection from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: SSL state (accept): before/accept initialization 2007.03.06 15:45:20 LOG6[17755:1026]: init_ssl: s_poll_wait timeout 2007.03.06 15:45:20 LOG5[17755:1026]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.06 15:45:20 LOG7[17755:1026]: smtps finished (0 left) 2007.03.06 15:47:00 LOG3[17753:1024]: Received signal 2; terminating Can anyone tell me what I am doing wrong? BB

1 0