stunnel-users

5 participants
3312 discussions

Client certificates still valid after removal with verify = 3
by Michael Brown 18 Oct '04

18 Oct '04

I'm having a problem with my stunnel 4.05 setup: We are using a setup where each client that connects has to have a valid certificate present on the filesystem (verify = 3). After the client connects once, it seems that the certificate is cached by either the SSL libraries or stunnel: stunnel.conf: <<< cert = /etc/stunnel/servercert.pem CAfile = /usr/share/ssl/CA/cacert.pem CApath = /etc/stunnel/clientdb verify = 3 [https] accept = 443 connect = remote.server.name:443 local = 192.168.0.6 >>> Some output: Oct 15 19:36:34 machine stunnel[14139]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:36:34 fruitfly stunnel[14139]: VERIFY OK: depth=0, /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com ... and the same thing after I remove the hash link in /etc/stunnel/clientdb. But only after I restart does it to the right thing: Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY OK: depth=1, /C=CA/ST=Ontario/L=Here/O=Us/OU=Bigwigs/CN=CA Cert/emailAddress=certainly(a)here.com Oct 15 19:40:24 fruitfly stunnel[15247]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=Ontario/O=Us/OU=slackers anonymous/CN=Daniel Unceman/emailAddress=dunce(a)here.com Help! We don't want to have to restart stunnel every time we remove a user. Thanks, Michael Brown -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb(a)opentext.com | termination of their C programs.' - Firth

2 1

New feature
by Michal Trojnara 18 Oct '04

18 Oct '04

Dear Users, New line in stunnel 4.06 ChangeLog: - Multiple connect=host:port options are allowed in a single service section. Remote hosts are connected using round-robin algorithm. What do you think? Best regards, Mike

7 9

Using stunnel with HTTP as server and client
by Wayne A Collins 14 Oct '04

14 Oct '04

I am new to the product and encryption as well, but am looking for some unix examples using with an HTTP client and a server to communicate with HTTP/S applications. I have looked through the archives, but they only go back 3 months. I know this has had to have been done many times but am missing something. Thanks, Wayne A. Collins IBM Global Services IT Architect, eBI - Communications & Public Sectors wacollin(a)us.ibm.com 941-792-0448 Office 800-759-8888 Pin # 1019403 Pager

3 2

Re: Problem running Stunnel
by Olivier Kaloudoff 13 Oct '04

13 Oct '04

Hi Robert, > When I run stunnel nothing seems to be happening. The terminal > accepts the command but does nothing. The log file doesn't produce any > output either nor does running stunnel in the foreground. (...) > What is meant to happen when I run stunnel, is there a way that I > can test if it is working. I previously tested imapd using telnet 0 143. > I'm using this > http://www.stepwise.com/Articles/Workbench/eart.4.0.html > article but its out of date, uses 3.x command line inputs, so I've tried > to convert those to the config file. put the following in your stunnel.conf to have useful debugging informations for 4.x: # Some debugging stuff debug = 7 output = /tmp/stunnel.log # comment out pid = line, that causes problems. # (to be re-enabled later if you need) # pid = /tmp/stunnel.pid launch your stunnel process with the following: stunnel stunnel.conf and watch your logfile at the same time: tail -f /tmp/stunnel.log Regards, Olivier

1 0

Stunnel V4.05 error with rsync
by craig hobbs 12 Oct '04

12 Oct '04

Hello, I am using stunnel v4.05 with rsync v2.6.0 and solaris9 as both my client and server machine. I am running rsync in daemon mode on the server and starting an rsync transfer on the client. I am getting a frequent error where my rsync client process just appears to hang. On the client side I will receive several 'SSL_read returned WANT_: retrying/SSL_write returned WANT_: retrying' messages back-to-back and then finally the message is always 'Socket closed on read'. Some data does get transferred but it appears from the messages that the socket looses its connection, and the the rsync process just hangs until time-out. Currently in no-blocking mode with the following limits: FD_SETSIZE=1024, file ulimit=2147483647 -> 500 clients allowed Is there any stunnel bug or system resource limit that could be the problem ?? Thanks for the help. ~Craig stunnel.conf file example from client: # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 cert = /usr/local/etc/stunnel/stunnel.pem #chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/tmp/stunnel.pid #setuid = nobody #setgid = nogroup # Some debugging stuff debug = 7 output = /var/tmp/stunnel.log foreground = yes # Use it for client mode client = yes # Service-level configuration [rsync] accept = 8000 connect = some_host.com:20000 stunnel log file example from client: 2004.10.11 14:44:32 LOG7[26651:7]: rsync started 2004.10.11 14:44:32 LOG5[26651:7]: rsync connected local_host_ip:43586 2004.10.11 14:44:32 LOG7[26651:7]: FD 9 in non-blocking mode 2004.10.11 14:44:32 LOG7[26651:7]: rsync connecting remote_host_ip:20000 2004.10.11 14:44:32 LOG7[26651:7]: remote connect #1: EINPROGRESS: retrying 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=write 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: Remote FD=9 initialized 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): before/connect initialization 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write client hello A 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: FD=9, DIR=read 2004.10.11 14:44:32 LOG7[26651:7]: waitforsocket: ok 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read server hello A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 read finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write change cipher spec A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 write finished A 2004.10.11 14:44:32 LOG7[26651:7]: SSL state (connect): SSLv3 flush data 2004.10.11 14:44:32 LOG7[26651:7]: 3 items in the session cache 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects (SSL_connect()) 2004.10.11 14:44:32 LOG7[26651:7]: 6 client connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 client renegotiatations requested 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects (SSL_accept()) 2004.10.11 14:44:32 LOG7[26651:7]: 0 server connects that finished 2004.10.11 14:44:32 LOG7[26651:7]: 0 server renegotiatiations requested 2004.10.11 14:44:32 LOG7[26651:7]: 3 session cache hits 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache misses 2004.10.11 14:44:32 LOG7[26651:7]: 0 session cache timeouts 2004.10.11 14:44:32 LOG6[26651:7]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc =AES(256) Mac=SHA1 2004.10.11 14:44:59 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:44:59 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:06 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:45:10 LOG7[26651:7]: SSL_read returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL_write returned WANT_: retrying 2004.10.11 14:46:32 LOG7[26651:7]: SSL socket closed on SSL_read

2 1

connection timeout
by SqM 10 Oct '04

10 Oct '04

Hi! I have an application that itself has the possibility to use a backup server. I.e config of primary and secondary server. I have set up the application to connect to localhost on 2 different ports ( 1000 and 1001 ) and each of the ports are forwarded to a primary and secondary server. When testing this setup i find that if i route packets to the primary server to /dev/null in order for the application to select the secondary server the application seems to be happy since stunnel answers. After aproxx 300 seconds i can see in the log that stunnel gives up and that the application sees this. The appliation then happily selects the secondary server. The question then is if it is possible to make stunnel a little bit faster in giving up.. I.e. perhaps 30 sec instead of 300 sec. I found one setting in the client config that seems to do this but the question is.. Is this the correct way to do it.. I.e. setting "TIMEOUTbusy = 30 seconds" seems to fix my problem but is this the rigth way or is there a better way? /Sqm

2 2

RE: [stunnel-users] RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 10 Oct '04

10 Oct '04

I have more information. I commented out chroot in the config file and it works. #chroot = /usr/local/var/run/stunnel/ -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]]On Behalf Of Garg, Jai V (Jai) Sent: Friday, October 08, 2004 6:04 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] RE: stunnel on Solaris 2.6 or 7? I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 -----Original Message----- From: Garg, Jai V (Jai) Sent: Friday, October 08, 2004 3:42 PM To: stunnel-users(a)mirt.net Subject: stunnel on Solaris 2.6 or 7? Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

2 2

NFS over Stunnel
by E SA 09 Oct '04

09 Oct '04

Hi, Is there anbody running NFS over Srunnel? I need to do so for Solaris. Can this be done? Has anybody done it? Any pointers? Beforehand, thank you for your help. Best regards, Erick Sanz _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com

3 2

RE: stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 08 Oct '04

08 Oct '04

I have more informaton on the problem. It is giving the following error when doing pthread_create() in create_client() open(/dev/zero): No such file or directory libthread panic: alloc_chunk (PID: 8605 LWP 1) stacktrace: ef3c9938 ef3c83e8 ef3c8184 ef3cebf0 ef3cbdf8 ef3cfe80 1ad24 1ba28 1bbb8 13e68 0 > -----Original Message----- > From: Garg, Jai V (Jai) > Sent: Friday, October 08, 2004 3:42 PM > To: stunnel-users(a)mirt.net > Subject: stunnel on Solaris 2.6 or 7? > > Hello, > Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. > I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: > > 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 > 04 > 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG > 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully > 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed > 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket > 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 > 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode > 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid > 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 > 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode > > I appreciate all help with this. > > Jai

1 0

stunnel on Solaris 2.6 or 7?
by Garg, Jai V (Jai) 08 Oct '04

08 Oct '04

Hello, Has anyone successfully used stunnel on Solaris 2.6 or Solaris 7? I would appreciate if you can provide the binary. I am using gcc (tried both 3.3.2 and 3.4.2) on 2.6. It compiles, but it seems to hang somewhere after accepting a connection. Here's the log: 2004.10.08 13:05:20 LOG5[21833:1]: stunnel 4.05 on sparc-sun-solaris2.6 PTHREAD with OpenSSL 0.9.7d 17 Mar 20 04 2004.10.08 13:05:20 LOG7[21833:1]: RAND_status claims sufficient entropy for the PRNG 2004.10.08 13:05:20 LOG6[21833:1]: PRNG seeded successfully 2004.10.08 13:05:20 LOG5[21833:1]: FD_SETSIZE=1024, file ulimit=64 -> 29 clients allowed 2004.10.08 13:05:20 LOG7[21833:1]: FD 4 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: SO_REUSEADDR option set on accept socket 2004.10.08 13:05:20 LOG7[21833:1]: SeS_SOCKS_NJ bound to 0.0.0.0:1373 2004.10.08 13:05:20 LOG7[21833:1]: FD 5 in non-blocking mode 2004.10.08 13:05:20 LOG7[21833:1]: FD 6 in non-blocking mode 2004.10.08 13:05:20 LOG7[21834:1]: Created pid file /stunnel-client.pid 2004.10.08 13:05:25 LOG7[21834:1]: SeS_SOCKS_NJ accepted FD=0 from 155.184.22.17:62844 2004.10.08 13:05:25 LOG7[21834:1]: FD 0 in non-blocking mode I appreciate all help with this. Jai

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users