Hi all,
I am trying to run Stunnel 4.05 on AIX 5.2 to secure our homegrown
webserver. I have been searching archives all over the place, and have yet
to find the answer, but have found many comments here and there that seem to
indicate a problem with Stunnel on AIX. The problem, in a nutshell, is that
I get an error on SSL_read in the stunnel log and it shuts down with a
segmentation fault after the first connection, no matter what I do.
Configuration info attached below. Any help anyone can give would be greatly
appreciatted.
Thanks
Baker
stunnel 4.05 on powerpc-ibm-aix5.2.0.0 FORK with OpenSSL 0.9.7d 17 Mar 2004
Global options
cert = /usr/local/etc/stunnel/stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
debug = 5
key = /usr/local/etc/stunnel/stunnel.pem
pid = /usr/local/var/run/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
session = 300 seconds
verify = none
Service-level options
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTidle = 43200 seconds
OpenSSL 0.9.7d 17 Mar 2004
conf-file:
cert = /usr/local/ssl/stunnel.pem
#chroot = /usr/local/var/run/stunnel/
pid = /usr/local/etc/stunnel/stunnel.pid
setuid = HTTPD
setgid = rrms
#options = DONT_INSERT_EMPTY_FRAGMENTS
# Some debugging stuff
debug = 7
output = stunnel.log
# Use it for client mode
#client = yes
foreground = yes
# Service-level configuration
[https]
accept = 443
connect = 80
TIMEOUTclose = 0
stunnel - log (from running openssl s_client command to test setup):
2004.08.19 15:22:29 LOG5[16718:0]: stunnel 4.05 on powerpc-ibm-aix5.2.0.0
FORK w
ith OpenSSL 0.9.7d 17 Mar 2004
2004.08.19 15:22:29 LOG4[16718:0]: Wrong permissions on
/usr/local/ssl/stunnel.p
em
2004.08.19 15:22:29 LOG7[16718:0]: Snagged 64 random bytes from //.rnd
2004.08.19 15:22:29 LOG7[16718:0]: Wrote 1024 new random bytes to //.rnd
2004.08.19 15:22:29 LOG7[16718:0]: RAND_status claims sufficient entropy for
the
PRNG
2004.08.19 15:22:29 LOG6[16718:0]: PRNG seeded successfully
2004.08.19 15:22:29 LOG7[16718:0]: Certificate: /usr/local/ssl/stunnel.pem
2004.08.19 15:22:29 LOG7[16718:0]: Key file: /usr/local/ssl/stunnel.pem
2004.08.19 15:22:29 LOG5[16718:0]: FD_SETSIZE=65534, file ulimit=65534 ->
31999
clients allowed
2004.08.19 15:22:29 LOG7[16718:0]: FD 4 in non-blocking mode
2004.08.19 15:22:29 LOG7[16718:0]: SO_REUSEADDR option set on accept socket
2004.08.19 15:22:29 LOG7[16718:0]: https bound to 0.0.0.0:443
2004.08.19 15:22:29 LOG7[16718:0]: FD 5 in non-blocking mode
2004.08.19 15:22:29 LOG7[16718:0]: FD 6 in non-blocking mode
2004.08.19 15:22:29 LOG7[16718:0]: Created pid file
/usr/local/etc/stunnel/stunn
el.pid
2004.08.19 15:22:30 LOG7[16718:0]: https accepted FD=7 from **ip**:33519
2004.08.19 15:22:30 LOG7[16718:0]: FD 7 in non-blocking mode
2004.08.19 15:22:30 LOG7[21344:0]: https started
2004.08.19 15:22:30 LOG5[21344:0]: https connected from **ip**:33519
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): before/accept
initializat
ion
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read client
hello A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write server
hello
A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write
certificate A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write server
done A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 flush data
2004.08.19 15:22:30 LOG7[21344:0]: waitforsocket: FD=7, DIR=read
2004.08.19 15:22:30 LOG7[21344:0]: waitforsocket: ok
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read client key
exc
hange A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 read finished A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write change
cipher
spec A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 write finished
A
2004.08.19 15:22:30 LOG7[21344:0]: SSL state (accept): SSLv3 flush data
2004.08.19 15:22:30 LOG7[21344:0]: 1 items in the session cache
2004.08.19 15:22:30 LOG7[21344:0]: 0 client connects (SSL_connect())
2004.08.19 15:22:30 LOG7[21344:0]: 0 client connects that finished
2004.08.19 15:22:30 LOG7[21344:0]: 0 client renegotiatations requested
2004.08.19 15:22:30 LOG7[21344:0]: 1 server connects (SSL_accept())
2004.08.19 15:22:30 LOG7[21344:0]: 1 server connects that finished
2004.08.19 15:22:30 LOG7[21344:0]: 0 server renegotiatiations requested
2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache hits
2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache misses
2004.08.19 15:22:30 LOG7[21344:0]: 0 session cache timeouts
2004.08.19 15:22:30 LOG6[21344:0]: Negotiated ciphers: AES256-SHA
S
SLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2004.08.19 15:22:30 LOG7[21344:0]: FD 4 in non-blocking mode
2004.08.19 15:22:30 LOG7[21344:0]: https connecting 127.0.0.1:80
2004.08.19 15:22:30 LOG7[21344:0]: Remote FD=4 initialized
2004.08.19 15:22:32 LOG7[21344:0]: Socket closed on read
2004.08.19 15:22:32 LOG7[21344:0]: SSL write shutdown (output buffer empty)
2004.08.19 15:22:32 LOG7[21344:0]: SSL alert (write): warning: close notify
2004.08.19 15:22:32 LOG7[21344:0]: SSL_shutdown retrying
2004.08.19 15:22:32 LOG7[21344:0]: select timeout waiting for SSL
close_notify
2004.08.19 15:22:32 LOG5[21344:0]: Connection closed: 311 bytes sent to SSL,
9 b
ytes sent to socket
2004.08.19 15:22:32 LOG7[21344:0]: removing pid file
/usr/local/etc/stunnel/stun
nel.pid
2
3
Hi,
Is it possible to configure STUNNEL to provide support for STARTTLS with
IMAP (Microsoft Exchange Server doesn't support this)
Have a look at RFC2595 http://www.faqs.org/rfcs/rfc2595.html
The reason is - Symbian cell phones only allow secure IMAP via this
method they can't connect to SIMAP.
Please help
Thanks
2
1
17 Aug '04
Charles,
Check to see if you are being bitten by the "Eudora" problem -- add the following line to the top of your stunnel.conf file, and see if it magically starts working:
options = DONT_INSERT_EMPTY_FRAGMENTS
You can also see a related set of mails from myself, describing the problem we had.
Regards,
David Hansen
-----Original Message-----
From: stunnel-users-admin(a)mirt.net
[mailto:[email protected]]On Behalf Of Charles A. Monteiro
Sent: Dienstag, 17. August 2004 18:31
To: stunnel-users(a)mirt.net
Subject: [stunnel-users] Newbie: Keep getting connection closed
We are using a proprietary protocol over tcp/ip which works fine and has
for a number of years. I have tested it without stunnel and it checks fine
as well. I keep getting the connection closed when I run through stunnel.
I don't understand if something bad has actually happened i.e. from the
error warnings. Is an "alert" a bad thing i.e. does it indicate that
something is broken? Does stunnel normally close the connection after
every message exchange? I have included the logs for both the stunnel
client and server as well as the respective conf files.
thanks in advance,
-Charles
---------------------------------------
client log:
2004.08.17 11:13:27 LOG7[1824:1544]: 55555 accepted FD=536 from
127.0.0.1:1085
2004.08.17 11:13:27 LOG7[1824:1544]: FD 536 in non-blocking mode
2004.08.17 11:13:27 LOG7[1824:1544]: Creating a new thread
2004.08.17 11:13:27 LOG7[1824:1544]: New thread created
2004.08.17 11:13:27 LOG7[1824:1040]: 55555 started
2004.08.17 11:13:27 LOG5[1824:1040]: 55555 connected from 127.0.0.1:1085
2004.08.17 11:13:27 LOG7[1824:1040]: FD 564 in non-blocking mode
2004.08.17 11:13:27 LOG7[1824:1040]: 55555 connecting 192.168.20.76:55555
2004.08.17 11:13:27 LOG7[1824:1040]: remote connect #1: EWOULDBLOCK:
retrying
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=write
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok
2004.08.17 11:13:27 LOG7[1824:1040]: Remote FD=564 initialized
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): before/connect
initialization
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
client hello A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
server hello A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
server certificate A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
server done A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
client key exchange A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
change cipher spec A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
finished A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 flush data
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=read
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
finished A
2004.08.17 11:13:27 LOG7[1824:1040]: 6 items in the session cache
2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects (SSL_connect())
2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects that finished
2004.08.17 11:13:27 LOG7[1824:1040]: 0 client renegotiatations requested
2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects (SSL_accept())
2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects that finished
2004.08.17 11:13:27 LOG7[1824:1040]: 0 server renegotiatiations
requested
2004.08.17 11:13:27 LOG7[1824:1040]: 1 session cache hits
2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache misses
2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache timeouts
2004.08.17 11:13:27 LOG6[1824:1040]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2004.08.17 11:13:27 LOG7[1824:1040]: Socket closed on read
2004.08.17 11:13:27 LOG7[1824:1040]: SSL write shutdown (output buffer
empty)
2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (write): warning: close
notify
2004.08.17 11:13:27 LOG7[1824:1040]: SSL_shutdown retrying
2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (read): warning: close
notify
2004.08.17 11:13:27 LOG7[1824:1040]: SSL closed on SSL_read
2004.08.17 11:13:27 LOG7[1824:1040]: Socket write shutdown (output buffer
empty)
2004.08.17 11:13:27 LOG5[1824:1040]: Connection closed: 110 bytes sent to
SSL, 13 bytes sent to socket
2004.08.17 11:13:27 LOG7[1824:1040]: 55555 finished (0 left)
-------------------------------------------------------------
server log:
2004.08.17 11:03:12 LOG7[28177:3073021920]: 55555 accepted FD=7 from
192.168.20.77:1086
2004.08.17 11:03:12 LOG7[28177:3073021920]: FD 7 in non-blocking mode
2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 started
2004.08.17 11:03:12 LOG5[28177:3062528944]: 55555 connected from
192.168.20.77:1086
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept):
before/accept initialization
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read
client hello A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write server hello A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write certificate A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write server done A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
flush data
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read
client key exchange A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read
finished A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write change cipher spec A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write finished A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
flush data
2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 items in the session cache
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects
(SSL_connect())
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects that
finished
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client renegotiatations
requested
2004.08.17 11:03:12 LOG7[28177:3062528944]: 18 server connects
(SSL_accept())
2004.08.17 11:03:12 LOG7[28177:3062528944]: 10 server connects that
finished
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 server renegotiatiations
requested
2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 session cache hits
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 session cache misses
2004.08.17 11:03:12 LOG7[28177:3062528944]: 6 session cache timeouts
2004.08.17 11:03:12 LOG6[28177:3062528944]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2004.08.17 11:03:12 LOG7[28177:3062528944]: FD 8 in non-blocking mode
2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 connecting
192.168.20.76:4242
2004.08.17 11:03:12 LOG7[28177:3062528944]: remote connect #1:
EINPROGRESS: retrying
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=8, DIR=write
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok
2004.08.17 11:03:12 LOG7[28177:3062528944]: Remote FD=8 initialized
2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket closed on read
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (write): warning:
close notify
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL write shutdown (output
buffer empty)
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (read): warning:
close notify
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL closed on SSL_read
2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket write shutdown (output
buffer empty)
2004.08.17 11:03:12 LOG5[28177:3062528944]: Connection closed: 13 bytes
sent to SSL, 110 bytes sent to socket
2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 finished (0 left)
-------------------------------------------------------------------------------------------------------------------
My client stunnel.conf:
cert=stunnel.pem
client=yes
debug=7
[55555]
accept=localhost:55555
connect=192.168.20.76:55555
- eof -
My server stunnel.conf:
cert=stunnel.pem
debug=7
output=stunnel.err
[55555]
accept=192.168.20.76:55555
connect=192.168.20.76:4242
- eof -
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
_______________________________________________
stunnel-users mailing list
stunnel-users(a)mirt.net
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
Visit our website at http://www.ubs.com
This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please
notify the sender immediately by e-mail if you have received this
e-mail by mistake and delete this e-mail from your system.
E-mail transmission cannot be guaranteed to be secure or error-free
as information could be intercepted, corrupted, lost, destroyed,
arrive late or incomplete, or contain viruses. The sender therefore
does not accept liability for any errors or omissions in the contents
of this message which arise as a result of e-mail transmission. If
verification is required please request a hard-copy version. This
message is provided for informational purposes and should not be
construed as a solicitation or offer to buy or sell any securities or
related financial instruments.
2
1
> Amazing how none of the OpenBSD packages ever actually seem to work. :)
Whoa - them's fighting words.
;-)
(Happily a Debian Linux user. My packages may be two years old, but
they work, dammit.)
--
Brian Hatch Anarchy: it's not the law,
Systems and it's just a good idea.
Security Engineer
http://www.ifokr.org/bri/
Every message PGP signed
1
0
We are using a proprietary protocol over tcp/ip which works fine and has
for a number of years. I have tested it without stunnel and it checks fine
as well. I keep getting the connection closed when I run through stunnel.
I don't understand if something bad has actually happened i.e. from the
error warnings. Is an "alert" a bad thing i.e. does it indicate that
something is broken? Does stunnel normally close the connection after
every message exchange? I have included the logs for both the stunnel
client and server as well as the respective conf files.
thanks in advance,
-Charles
---------------------------------------
client log:
2004.08.17 11:13:27 LOG7[1824:1544]: 55555 accepted FD=536 from
127.0.0.1:1085
2004.08.17 11:13:27 LOG7[1824:1544]: FD 536 in non-blocking mode
2004.08.17 11:13:27 LOG7[1824:1544]: Creating a new thread
2004.08.17 11:13:27 LOG7[1824:1544]: New thread created
2004.08.17 11:13:27 LOG7[1824:1040]: 55555 started
2004.08.17 11:13:27 LOG5[1824:1040]: 55555 connected from 127.0.0.1:1085
2004.08.17 11:13:27 LOG7[1824:1040]: FD 564 in non-blocking mode
2004.08.17 11:13:27 LOG7[1824:1040]: 55555 connecting 192.168.20.76:55555
2004.08.17 11:13:27 LOG7[1824:1040]: remote connect #1: EWOULDBLOCK:
retrying
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=write
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok
2004.08.17 11:13:27 LOG7[1824:1040]: Remote FD=564 initialized
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): before/connect
initialization
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
client hello A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
server hello A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
server certificate A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
server done A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
client key exchange A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
change cipher spec A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 write
finished A
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 flush data
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: FD=564, DIR=read
2004.08.17 11:13:27 LOG7[1824:1040]: waitforsocket: ok
2004.08.17 11:13:27 LOG7[1824:1040]: SSL state (connect): SSLv3 read
finished A
2004.08.17 11:13:27 LOG7[1824:1040]: 6 items in the session cache
2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects (SSL_connect())
2004.08.17 11:13:27 LOG7[1824:1040]: 7 client connects that finished
2004.08.17 11:13:27 LOG7[1824:1040]: 0 client renegotiatations requested
2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects (SSL_accept())
2004.08.17 11:13:27 LOG7[1824:1040]: 0 server connects that finished
2004.08.17 11:13:27 LOG7[1824:1040]: 0 server renegotiatiations
requested
2004.08.17 11:13:27 LOG7[1824:1040]: 1 session cache hits
2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache misses
2004.08.17 11:13:27 LOG7[1824:1040]: 0 session cache timeouts
2004.08.17 11:13:27 LOG6[1824:1040]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2004.08.17 11:13:27 LOG7[1824:1040]: Socket closed on read
2004.08.17 11:13:27 LOG7[1824:1040]: SSL write shutdown (output buffer
empty)
2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (write): warning: close
notify
2004.08.17 11:13:27 LOG7[1824:1040]: SSL_shutdown retrying
2004.08.17 11:13:27 LOG7[1824:1040]: SSL alert (read): warning: close
notify
2004.08.17 11:13:27 LOG7[1824:1040]: SSL closed on SSL_read
2004.08.17 11:13:27 LOG7[1824:1040]: Socket write shutdown (output buffer
empty)
2004.08.17 11:13:27 LOG5[1824:1040]: Connection closed: 110 bytes sent to
SSL, 13 bytes sent to socket
2004.08.17 11:13:27 LOG7[1824:1040]: 55555 finished (0 left)
-------------------------------------------------------------
server log:
2004.08.17 11:03:12 LOG7[28177:3073021920]: 55555 accepted FD=7 from
192.168.20.77:1086
2004.08.17 11:03:12 LOG7[28177:3073021920]: FD 7 in non-blocking mode
2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 started
2004.08.17 11:03:12 LOG5[28177:3062528944]: 55555 connected from
192.168.20.77:1086
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept):
before/accept initialization
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read
client hello A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write server hello A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write certificate A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write server done A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
flush data
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=7, DIR=read
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read
client key exchange A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3 read
finished A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write change cipher spec A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
write finished A
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL state (accept): SSLv3
flush data
2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 items in the session cache
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects
(SSL_connect())
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client connects that
finished
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 client renegotiatations
requested
2004.08.17 11:03:12 LOG7[28177:3062528944]: 18 server connects
(SSL_accept())
2004.08.17 11:03:12 LOG7[28177:3062528944]: 10 server connects that
finished
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 server renegotiatiations
requested
2004.08.17 11:03:12 LOG7[28177:3062528944]: 2 session cache hits
2004.08.17 11:03:12 LOG7[28177:3062528944]: 0 session cache misses
2004.08.17 11:03:12 LOG7[28177:3062528944]: 6 session cache timeouts
2004.08.17 11:03:12 LOG6[28177:3062528944]: Negotiated ciphers:
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2004.08.17 11:03:12 LOG7[28177:3062528944]: FD 8 in non-blocking mode
2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 connecting
192.168.20.76:4242
2004.08.17 11:03:12 LOG7[28177:3062528944]: remote connect #1:
EINPROGRESS: retrying
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: FD=8, DIR=write
2004.08.17 11:03:12 LOG7[28177:3062528944]: waitforsocket: ok
2004.08.17 11:03:12 LOG7[28177:3062528944]: Remote FD=8 initialized
2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket closed on read
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (write): warning:
close notify
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL write shutdown (output
buffer empty)
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL alert (read): warning:
close notify
2004.08.17 11:03:12 LOG7[28177:3062528944]: SSL closed on SSL_read
2004.08.17 11:03:12 LOG7[28177:3062528944]: Socket write shutdown (output
buffer empty)
2004.08.17 11:03:12 LOG5[28177:3062528944]: Connection closed: 13 bytes
sent to SSL, 110 bytes sent to socket
2004.08.17 11:03:12 LOG7[28177:3062528944]: 55555 finished (0 left)
-------------------------------------------------------------------------------------------------------------------
My client stunnel.conf:
cert=stunnel.pem
client=yes
debug=7
[55555]
accept=localhost:55555
connect=192.168.20.76:55555
- eof -
My server stunnel.conf:
cert=stunnel.pem
debug=7
output=stunnel.err
[55555]
accept=192.168.20.76:55555
connect=192.168.20.76:4242
- eof -
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
1
0
I have a tunnel that forwards connections from syslog-ng on
localhost to my loghost. Or rather, I don't.
In the stunnel logs, I repeatedly get:
2004.08.16 21:28:30 LOG5[23452:1006768128]: syslogngs connected from
127.0.0.1:32479
2004.08.16 21:28:30 LOG7[23452:1006768128]: SSL state (accept): before/accept
initialization
2004.08.16 21:28:30 LOG3[23452:1006768128]: SSL_accept: 140760FC:
error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
2004.08.16 21:28:30 LOG7[23452:1006768128]: syslogngs finished (2 left)
2004.08.16 21:28:31 LOG7[23452:1006693376]: SSL socket closed on SSL_read
2004.08.16 21:28:31 LOG5[23452:1006693376]: Connection closed: 0 bytes sent to SSL,
0 bytes sent to socket
2004.08.16 21:28:31 LOG7[23452:1006693376]: syslogngs finished (1 left)
2004.08.16 21:30:01 LOG7[23452:1006763008]: waitforsocket: ok
2004.08.16 21:30:01 LOG3[23452:1006763008]: SSL_accept: 140760FC: error:140760FC:SSL
routines:SSL23_GET_CLIENT_HELLO:unknown protocol
2004.08.16 21:30:01 LOG7[23452:1006763008]: syslogngs finished (0 left)
..yet connecting using:
$ openssl s_client -connect localhost:5515
successfully connects to my loghost and prints the certificate details.
Why on earth will s_client connect and not syslog-ng?
Specific details:
192.168.1.6
syslog-ng -> localhost:5515
|
stunnel <----------|
|
stunnel ----------> loghost:5514
loghost:
192.168.1.7
(hosts) ---> stunnel (192.168.1.7:5514)
|
syslog-ng (localhost:5515)
I have now been trying to implement encrypted logging for a record time
of three months now and so far every attempt has failed in some way or
another. Can somebody please put an end to this adminstrative misery?
(more verbose program output on request)
mark
1
1
Hi. I'm so close to having a working loghost, with stunnel encrypted connections.
Not close enough however.
I have syslog-ng setup to log to 127.0.0.1:5515 on all clients.
The client config:
[syslogngs]
accept = 127.0.0.1:5515
connect = 192.168.1.7:5514
On the loghost, stunnel listens on *.5514 and forwards to connection to
127.0.0.1:5515 (which syslog-ng is listening on).
(server config):
[syslogngs]
accept = 192.168.1.7:5514
connect = 127.0.0.1:5515
I'm making an assumption that the certificates are working, as I'm
using (or attempting to use) both client and server authentication.
Watching the stream with a packet sniffer shows absolutely no connections
between the client and the loghost. Strings such as this appear in the
stunnel.log repeatedly:
2004.08.16 20:42:26 LOG7[7690:1006693376]: syslogngs started
2004.08.16 20:42:26 LOG5[7690:1006693376]: syslogngs connected from
127.0.0.1:2956
2004.08.16 20:42:26 LOG7[7690:1006693376]: SSL state (accept): before/accept
initialization
2004.08.16 20:42:26 LOG7[7690:1006693376]: waitforsocket: FD=13, DIR=read
2004.08.16 20:42:26 LOG7[7690:1006690304]: syslogngs accepted FD=14 from
127.0.0.1:24856
2004.08.16 20:42:26 LOG7[7690:1006690304]: FD 14 in non-blocking mode
2004.08.16 20:42:26 LOG7[7690:1006763008]: syslogngs started
2004.08.16 20:42:26 LOG5[7690:1006763008]: syslogngs connected from 127.0.0.1:24856
2004.08.16 20:42:26 LOG7[7690:1006763008]: SSL state (accept): before/accept
initialization
2004.08.16 20:42:26 LOG7[7690:1006763008]: waitforsocket: FD=14, DIR=read
2004.08.16 20:42:26 LOG7[7690:1006763008]: waitforsocket: ok
2004.08.16 20:42:26 LOG3[7690:1006763008]: SSL_accept: 140760FC: error:140760FC:SSL
routines:SSL23_GET_CLIENT_HELLO:unknown protocol
2004.08.16 20:42:26 LOG7[7690:1006763008]: syslogngs finished (1 left)
2004.08.16 20:47:26 LOG7[7690:1006693376]: waitforsocket: timeout
2004.08.16 20:47:26 LOG7[7690:1006693376]: syslogngs finished (0 left)
Have I made some glaring error that I'm not aware of?
thanks
mark
1
0