stunnel-users

3306 discussions

exclusively TLS
by Moehrke, John (GE Healthcare) 20 Jan '06

20 Jan '06

I need to talk to a server that is requiring pure TLS. It seems that STUNNEL always starts with SSL. How do I get STUNNEL to start the client side conversation with TLS? John Moehrke Enterprise Security Architect GE Healthcare T 262 293 1667 W126 N7449 Flint Road, Suite 200, Menomonee Falls, WI 53051 John.Moehrke(a)med.ge.com <mailto:[email protected]> www.gehealthcare.com <http://www.gehealthcare.com/> What I may see or hear in the course of the treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep to myself, holding such things shameful to be spoken about. (One Portion of the Hippocratic Oath - Hippocrates, circa 400 B.C.)

2 1

Stunnel in a three tier setup
by Louis Young 19 Jan '06

19 Jan '06

Hi Guys I would like to set up stunnel in a three tier environment, i.e. instead of just having a client and a server, I have a client, midware and server. I tried doing this: On the client: [VNC on TestMachine] accept = 9000 connect = 192.168.100.12:9000 192.168.100.12 is the "mid-ware" machine: On this "mid-ware" machine: [VNC on TestMachine] accept = 9000 connect = 192.168.100.16:9000 192.168.100.16 is the destination: Then on the destination: [VNC] accept = 9000 connect = 192.168.100.16:5900 The only machine with client=yes is the client and they all use the same key. If I change the settings on the client to point directly to the destination (i.e. using only two machines), it works, but with three machines there seems to be a problem Any ideas? Regards, Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 1

verify server certification is missing
by Olivier twist 17 Jan '06

17 Jan '06

I think a functionnality is missing in stunnel. I compare the behaviour of stunnel and apache mod-ssl. If you have a certificate signed by third party, apache checks the root certificate like stunnel do this with -v 1 option but apache don't ask for a client certificate, stunnel do this :-( I think that stunnel should control server certificate chain defined in CA file even if option -v 1 is not set !!! Could you give your opinion? If I use stunnel and not apache it's because I have some protocols to handle with ssl and stunnel is a very easy to use solution. Thanks Oliver

1 0

Delay option
by Stefaan Van Dooren 16 Jan '06

16 Jan '06

Hi, I'm setting up stunnel and I'm facing a problem with dynamic IP-adresses. Searching google and the man pages I tought that the "delay = yes" option would solve my problem, but it doesn't seems to. If I had "delay = yes" to my config file, none of my services seems to work anymore. If I remove it, everything is working fine, until the the remote-IP changes, and I have to restart stunnel. What am I doing wrong ? Or isn't this the right option for this job ? Stunnel -version : stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds Stefaan

2 1

Connection Refused by libwrap
by Eddie Atherton 16 Jan '06

16 Jan '06

Hi, With Version 4.14, I've now started seeing the following messages occaisionally when I fire up 4 concurrent connections from my Windows box, via stunnel on Linux, to my NewsServer: Jan 3 17:55:13 The-Tardis stunnel: LOG3[17760:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17760:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[17761:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[17761:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:399]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:399]: Connection from 192.168.0.2:2073 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:400]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:400]: Connection from 192.168.0.2:2074 REFUSED by libwrap Jan 3 17:55:13 The-Tardis stunnel: LOG3[3824:401]: Unexpected socket close (read_blocking) Jan 3 17:55:13 The-Tardis stunnel: LOG4[3824:401]: Connection from 192.168.0.2:2075 REFUSED by libwrap Following this, the connections continues as normal. Now, ASAIK, I'm not using the wrappers. I'm starting stunnel as a daemon, in rc.local. There are no entries in inetd.conf for the port that the windows machine connects from. Here's the relevent parts of the config file: ; Use it for client mode client = yes [nntps] accept = 563 connect = newsgroups.comcast.net:563 Cheers, Eddie

2 2

need help with verify 1 option
by Olivier twist 13 Jan '06

13 Jan '06

2 2

Some newbie question for stunnel
by Thomas Stein 13 Jan '06

13 Jan '06

Hello, After reading some doc pages about stunnel I have still some questions: 1.) I read that the client part of a pop3 connection (e.g. for GoogleMail) is like stunnel -c -d pop3 -r bar:pop3s However I did not found any explations of the flags -d, -d and -r When I type stunnel -help none of these flags are explained. 2.) Can I replace pop3 and pop3s in the command above by real port numbers? 3.) Is stunnel compatible with SSH servers ? In other words: can stunnel on the local machine communicate with a SSH server on the remote computer and vice versa? 4.) Is there a timeout function? Read: When I start stunnel I would like to exit the service after lets say 5 minutes automatically. Is there such a feature/option? 5.) Has someone experiences with googlemail pop3 retrieval of emails? Is the following stunnel command recommendable for googlemail.com? stunnel -c -d pop3 -r pop.googlemail.com:pop3 Thank you in advance for the answer Thomas -- ___________________________________________________ Play 100s of games for FREE! http://games.mail.com/

2 1

Sniffing the network --how to disable SSL?
by david-e.hansen＠ubs.com 12 Jan '06

12 Jan '06

Hi, I know this sort of defeats the whole purpose of stunnel, but I have an LDAP server which listens for non-SSL on one port, and SSL on another. We decided to use stunnel and the SSL port on our LDAP server for security purposes. However, now we need to see the communication between clients and the LDAP server, in order to debug a production problem. Sniffing won't be terribly useful unless we can turn off the SSL encryption of the communication. I can't just re-point the application to the non-SSL port because this is stored in a central database and would affect everyone (it's a 3rd pty app), so I just want to change the stunnel.conf file on my PC so that it does port-forwarding but no encryption. Is this possible to do? Regards, David E. Hansen Stunnel version 4, LDAP version 3 Visit our website at http://www.ubs.com This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes and should not be construed as a solicitation or offer to buy or sell any securities or related financial instruments.

2 1

running on one machine stunnel server AND client
by Dan Beldiman 11 Jan '06

11 Jan '06

Hi, I am using stunnel4 (stunnel 4.09 on i386-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004) on debian linux. I want to run on one machine an stunnel server and an stunnel client, so it can recive a connection and also open a new connection to a different server (in the ascii graphic below server b) SERVER A SERVER B SERVER C | | | | ------>------ ----->---- The configuration file only allows me to specify client=yes or no, but I can not specify this for each connection. How can I set up a client and server on the same machine? Thanks Dan

2 3

Stunnel 4.14 & 4.15 don't compile on Tru64 (5.1A)!
by Alberto D'Ambrosio 11 Jan '06

11 Jan '06

Hi! I'd like to upgrade Stunnel from 4.04 to 4.14/4.15 on my Tru64 box, but it no longer compiles: ========================================= cc: Error: client.c, line 173: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 893: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t addrlen; ----^ cc: Error: client.c, line 1003: In this declaration, "socklen_t" must specify a type. (badparsedecl) socklen_t optlen; ----^ cc: Error: client.c, line 175: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Warning: client.c, line 259: In this statement, the referenced type of the pointer value "sid_ctx" is "unsigned char", which is not compatible with "const char" because they differ by signed/unsigned attribute. (ptrmismatch1) SSL_set_session_id_context(c->ssl, sid_ctx, strlen(sid_ctx)); -------------------------------------------------------^ cc: Error: client.c, line 904: In this statement, "addrlen" is not declared. (undeclared) addrlen=sizeof(SOCKADDR_UNION); ----^ cc: Error: client.c, line 1019: In this statement, "optlen" is not declared. (undeclared) optlen=sizeof(error); ------------^ *** Exit 1 Stop. *** Exit 1 Stop. ========================================= For your information: - Version 4.04 compiles and works fine. - Version 4.06 compiles but doesn't work: Jan 11 10:36:14 scilla stunnel[701061]: daemon_loop: s_poll_wait: Invalid argument (22) Jan 11 10:38:37 scilla last message repeated 77888 times Jan 11 10:36:44 scilla last message repeated 24118 times - any version >= 4.07 no longer compiles. - OpenSSL 0.9.8a compiles and works fine. Any help is appreciated. Ciao, Alberto

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users