stunnel-users

5 participants
3312 discussions

Stunnel.conf reload
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way, under win32, to have stunnel reload its .conf file and certificates without restarting the service ? (A kind of SIGHUP) Thanks, Phil

1 0

Stunnel and CRLs
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way to automagically mutually verify certificates (verify=3) and to check the certificates against a .crl file hosted on a web server ? I want my "VNC over Stunnel" host check if the incoming connexions are authorized or if the certificates have expired / been revoked. Thanks, Phil

1 0

stunnel 4.09 problem: Connection rejected: too many clients
by Steven Van Acker 04 Apr '05

04 Apr '05

Hi, after upgrading to stunnel 4.09, we are having 2 problems with it that did not exist in a previous version (our case: stunnel 4.05 without pthreads) ---[ My testsetup is as follows: * stunnel listening on port 4321, connects to localhost port 13 (daytime) * daytime is enabled in inetd * stunnel was compiled without pthreads * ulimit -u = 8192 ---[ problem 1 At first, it works fine. For every incoming connection, the process forks and data is transferred. However, when the connection is closed, the forked process remains hanging for a while (about 1 minute) and then exits. This in itself is not a real problem, except that it generates a lot of processes. (and maybe causes problem 2 ?) ---[ data and logs concerning problem 1 (process hangs for 1 minute): I run the following command: openssl s_client -connect 192.168.2.119:4321 the output follows immediately The logfile (debug = debug) looks like this: 2005.03.31 14:05:05 LOG7[4552:0]: daytime accepted FD=8 from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4552:0]: FD 8 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime started 2005.03.31 14:05:05 LOG5[4553:0]: daytime connected from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): before/accept initialization 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write certificate A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server done A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client key exchange A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write change cipher spec A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: 1 items in the session cache 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects (SSL_connect()) 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 client renegotiatations requested 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects (SSL_accept()) 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 server renegotiatiations requested 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache hits 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache misses 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache timeouts 2005.03.31 14:05:05 LOG6[4553:0]: SSL accepted: new session negotiated 2005.03.31 14:05:05 LOG6[4553:0]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.03.31 14:05:05 LOG7[4553:0]: FD 7 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime connecting 127.0.0.1:13 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: waiting 10 seconds 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: connected 2005.03.31 14:05:05 LOG7[4553:0]: Remote FD=7 initialized 2005.03.31 14:05:05 LOG7[4553:0]: Socket closed on read 2005.03.31 14:05:05 LOG7[4553:0]: SSL write shutdown 2005.03.31 14:05:05 LOG7[4553:0]: SSL alert (write): warning: close notify 2005.03.31 14:05:05 LOG7[4553:0]: SSL_shutdown retrying 2005.03.31 14:05:06 LOG7[4553:0]: SSL alert (read): warning: close notify 2005.03.31 14:05:06 LOG7[4553:0]: SSL closed on SSL_read 2005.03.31 14:05:06 LOG7[4553:0]: Socket write shutdown When I check netstat, the connection from the client to stunnel is in the CLOSE_WAIT state and the connection from stunnel to the daytime server is in TIME_WAIT state then 1 minute later, this follows: 2005.03.31 14:06:06 LOG6[4553:0]: s_poll_wait timeout: connection close 2005.03.31 14:06:06 LOG5[4553:0]: Connection closed: 26 bytes sent to SSL, 0 bytes sent to socket 2005.03.31 14:06:06 LOG7[4553:0]: removing pid file /stunnel.pid 2005.03.31 14:06:06 LOG7[4552:0]: Steven: going into client_status with num_clients = 1 2005.03.31 14:06:06 LOG7[4552:0]: Process 4553 finished with code 0 (0 left) Now, netstat no longer shows the connections in any state. ---[ problem 2 Another problem that was found is that after bombarding stunnel with lots of connections, it stops accepting new connections. This would be normal if all connections remained open, but they are all closed. This is the error: Mar 31 13:53:40 hostname stunnel[13044]: Connection rejected: too many clients (>=4000) netstat only shows +- 500 connections, of which none are aimed at the stunnel process in question (port 4321 in my test setup) there is only 1 stunnel process active aswell. I dug into the problem a bit and it probably has to do with num_clients not being decreased after a process is closed (although I can not find any specifics :/) greets, -- Steven

3 4

Terminal services and stunnel 4.09
by Mattias Olsson 01 Apr '05

01 Apr '05

Hi! Im tying to access an internal Win2003 terminal server from my Linux box (internet). As i understand it stunnel should do the work. I have read some documents but im not sure... This is my setup. Linuxbox ----> Linuxbox ssh server | Firewall | Terminal server i wish to access. Can this be done or do i have to open a port in the fw to access the TS directly? Should stunnel.conf look like this on my linuxbox (client) cert = /usr/local/etc/stunnel/mail.pem client = yes On the TS? [TS] accept = 3000 connect = 3389 Should it have cert = ? Or could i on my linux ssh server have a config looking like this: [TS-remote] accept = 3000 connect = <internal-ip>:3389 Should it have cert = ? A novice man sends his best regards and thanks! /Kaz -- Mvh / Regards Mattias Olsson - aka - KaZaMaNIaC

1 0

Does stunnel work on Windows 2000 & SIMP(Secure Instant Messaging) ??
by DK 01 Apr '05

01 Apr '05

Hi Group, I have a windows 2000 box & want to communicate securely with someone else via SIMP(Secure Instant Messaging Protocol - http://www.winfosec.com/simp.php) I know that SIMP Instant Messaging is a "Direct Connection" & does NOT go through an intermediary server & that its encrypted, but being the security nut I am, I want to know if "stunnel" handles the SIMP protocols ? ... as I can't find anywhere what the SIMP protocols are ... because as I have read in the stunnel FAQ, stunnel does not handle UDP. Regards, David __________________________________ Do you Yahoo!? Yahoo! Personals - Better first dates. More second dates. http://personals.yahoo.com

1 0

Pass IP
by Tim Brown 31 Mar '05

31 Mar '05

I am running Stunnel version 4.07 on a Windows 2000 server. Is there any way to pass the originating IP through Stunnel to my server application? As it is now Stunnel is passing the server IP for all requests. Thanks. Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

2 1

help
by Maddalena.Pulcini＠seleniacomms.com 31 Mar '05

31 Mar '05

Hi Mike, Thank you for your precious help. I am using stunnel as SSL client. The SSL server runs in a router. As you suggested me, I have done these changes: at first I have modified the stunnel.conf with options = SSL_OP_TLS_BLOCK_PADDING_BUG stunnel.conf ============================== client = yes debug=7 options = SSL_OP_TLS_BLOCK_PADDING_BUG [telnet] accept = 23 connect = 10.36.3.144:4433 ============================= but I have got this error ======================================= file stunnel.conf line 5: Illegal SSL option 2005.03.31 13:26:48 LOG3[3396:3716]: Server is down ======================================= After I have changed the stunnel.conf in this way: stunnel.conf ============================== client = yes debug=7 ciphers = RC4-MD5 [telnet] accept = 23 connect = 10.36.3.144:4433 ============================== The problem I had is now solved. But my question is: how can I know more about this protocol incompatibility? Is there an accurate documentation about that and also about stunnel configuration? Sorry but sometimes it's difficult for me to find (in the FAQ or other sessions) the informations that I need. Thanks&Regards Maddalena

2 1

Terminal services and stunnel 4.09
by Mattias Olsson 31 Mar '05

31 Mar '05

1 0

Re: [stunnel-users] Libssl32.dll and Libeay32.dll Patents
by Brian Hatch 30 Mar '05

30 Mar '05

> I live in Maryland, United States. Can somebody please tell me if there > is a patent or some kind of legal restriction on the Libssl32.dll and > Libeay32.dll files available in the > http://www.stunnel.org/download/stunnel/win32/ directory? I would > really like to avoid compiling OpenSSL manually...gave it a shot this > evening and it bombed. I need to use Stunnel for strictly internal > purposes and not for any profit. The IDEA algorithm is patented, but I don't think Mike included that in his builds. You can configure Stunnel to only use specific ciphers, in which case you wouldn't be using it regardless. Does that make it legal? Consult a lawyer. Software patents suck. I'd download the openssl.exe and the libs and run 'openssl.exe ciphers -v' and see exactly which ciphers it includes and avoid any from which your legal team suggess you run away. -- Brian Hatch If we aren't supposed Systems and to eat animals, why Security Engineer are they made of meat? http://www.ifokr.org/bri/ Every message PGP signed

1 0

Stunnel 4.09 released
by Michal Trojnara 26 Mar '05

26 Mar '05

New stunnel 4.09 can be found on my FTP site: ftp://stunnel.mirt.net/stunnel/ Here is the ChangeLog entry: * DLLs for OpenSSL 0.9.7f. * Bugfixes - Compilation problem with undeclarated socklen_t fixed. - TIMEOUTclose is not used when there is any data in the buffers. - Stunnel no longer relies on close_notify with SSL 2.0 connections, since SSL 2.0 protocol does not have any alerts defined. - Closing SSL socket when there is some data in SSL output buffer is detected and reported as an error. - Install/chmod race condition when installing default certificate fixed. - Stunnel no longer installs signal_handler on ignored signals. Best regards, Mike

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users