<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2769" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>
<P><FONT face=Arial>Have worked on this all day without any glimmer of hope and
would appreciate help and feedback!</FONT></P>
<P><FONT face=Arial>Regards,</FONT></P>
<P><FONT face=Arial>KAM</FONT></P>
<P><FONT face=Arial></FONT> </P>
<P># Description of your problem. What programs are on which machines, and how
are they attempting to communicate. What connections are you attempting to
secure in SSL.</P>
<P>I am having problems with the regeneration of stunnel on an old but fairly
reliable machine. I am switching from v3 to v4 and it works absolutely perfectly
ONCE. The second time it just hangs.</P>
<P># What version of Stunnel you're using - remember, Stunnel 4.x doesn't take
Stunnel 3.x command line options!</P>
<P>4.x</P>
<P># The list of parameters you are using for stunnel, and if you are running it
standalone or from inetd/xinetd.</P>
<P>I am running it in standalone. My conf file is:</P>
<P>cert = /usr/local/ssl/certs/stunnel.pem</P>
<P>key = /usr/local/ssl/certs/stunnel.pem</P>
<P>chroot = /usr/local/var/stunnel/</P>
<P>setuid = nobody</P>
<P>setgid = nobody</P>
<P>pid = /stunnel.pid</P>
<P>socket = l:TCP_NODELAY=1</P>
<P>socket = r:TCP_NODELAY=1</P>
<P>debug = 7</P>
<P>output = stunnel.log</P>
<P>[ssmtp]</P>
<P>accept = 465</P>
<P>connect = 10.10.10.30:25</P>
<P># Output of "stunnel -f -D 7 <your-parameters>".</P>
<P>Not sure this works on v4.X but here are the logs from the connection:</P>
<P>2005.11.18 19:17:56 LOG7[13166:1024]: ssmtp accepted FD=7 from
66.149.103.32:3542</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp started</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: FD 7 in non-blocking mode</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on local
socket</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: FD 11 in non-blocking mode</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: Connection from 66.149.103.32:3542
permitted by libwrap</P>
<P>2005.11.18 19:17:56 LOG5[13171:1026]: ssmtp connected from
66.149.103.32:3542</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): before/accept
initialization</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client
hello A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server
hello A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write
certificate A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server
done A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush
data</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client
key exchange A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read finished
A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write change
cipher spec A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write
finished A</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush
data</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 1 items in the session cache</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects (SSL_connect())</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects that finished</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 0 client renegotiatations requested</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects (SSL_accept())</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects that finished</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 0 server renegotiatiations
requested</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache hits</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 1 session cache misses</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache timeouts</P>
<P>2005.11.18 19:17:56 LOG6[13171:1026]: SSL accepted: new session
negotiated</P>
<P>2005.11.18 19:17:56 LOG6[13171:1026]: Negotiated ciphers: RC4-MD5 SSLv3
Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 </P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp connecting 10.10.10.30:25</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: waiting 10 seconds</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: connected</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: Remote FD=10 initialized</P>
<P>2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on remote
socket</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: Socket closed on read</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: SSL write shutdown</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: SSL alert (write): warning: close
notify</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: SSL_shutdown retrying</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: SSL doesn't need to read or write</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: SSL socket closed on SSL_read</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: Socket write shutdown</P>
<P>2005.11.18 19:17:58 LOG5[13171:1026]: Connection closed: 827 bytes sent to
SSL, 1362 bytes sent to socket</P>
<P>2005.11.18 19:17:58 LOG7[13171:1026]: ssmtp finished (-1 left)</P>
<P>There is nothing more after this point</P>
<P> </P>
<P># Output of "stunnel -V".</P>
<P><BR>I think you want -version:</P>
<P>/usr/local/sbin/stunnel -version</P>
<P>stunnel 4.14 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL
0.9.7e 25 Oct 2004</P>
<P></P>
<P>Global options</P>
<P>cert = /usr/local/etc/stunnel/stunnel.pem</P>
<P>ciphers = ALL:!ADH:+RC4:@STRENGTH</P>
<P>debug = 5</P>
<P>key = /usr/local/etc/stunnel/stunnel.pem</P>
<P>pid = /usr/local/var/stunnel/stunnel.pid</P>
<P>RNDbytes = 64</P>
<P>RNDfile = /dev/urandom</P>
<P>RNDoverwrite = yes</P>
<P>session = 300 seconds</P>
<P>verify = none</P>
<P></P>
<P>Service-level options</P>
<P>TIMEOUTbusy = 300 seconds</P>
<P>TIMEOUTclose = 60 seconds</P>
<P>TIMEOUTconnect = 10 seconds</P>
<P>TIMEOUTidle = 43200 seconds</P>
<P># Output of "uname -a".</P>
<P>Linux <removed> 2.2.26 #8 Fri Jul 16 00:42:34 EDT 2004 i686 unknown</P>
<P># Your libc version if you use Linux.</P>
<P>2.2.5</P>
<P># Output of "gcc -v".</P>
<P>Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs</P>
<P>gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)</P>
<P># Output of "openssl version" or "ssleay version" depending on your library.
Subscribe to stunnel-users.</P>
<P>OpenSSL 0.9.7e 25 Oct 2004</P></FONT></DIV></BODY></HTML>