- stunnel-users - stunnel.org

Re: [stunnel-users] STunnel as a Relay server
by Ludolf Holzheid 19 Sep '08

19 Sep '08

On Thu, 2008-09-18 15:02:56 -0400, Thomas O'Hare wrote: > Ludolf > > Just got this as the main mail server was down for several days. > > The Win EXE that installs the STunnel service is what I meant. Is there > a way to edit the configuration text file to skip tunneling. There is > an ancient app on some PCs that can use only port 25 and we want to use > STunnel to do both SSL & non-SSL relays so we do not have to install & > maintain 2 different packages to basically do the same thing. Thomas, Of course, you get a clear-text port redirector if you connect two instances of stunnel running on the same machine, one acting as client, the other one as server. But again, I think this is oversized and not easier to set up than a simple TCP port redirector. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Bug in tools stunnel.init
by Kevin A. McGrail 17 Sep '08

17 Sep '08

Hi Michael, I've upgraded to stunnel 4.25 and found a few small bugs in the init script. In stunnel.init.in, I'm pretty sure the DAEMON line should be DAEMON=@prefix@/bin/stunnel and not DAEMON=@prefix@/etc/stunnel Also, when the parent process is killed with stop, I see Sep 17 14:34:16 server stunnel: warning: can't get client address: Bad file descriptor because the child processes seem to stick around. I've modified the init script to kill the main process using the pid file and then using pidof to identify and kill the remaining child processes. Is this expected behavior? regards, KAM

2 2

Non-SSL Relay
by Thomas O'Hare 17 Sep '08

17 Sep '08

Hello I know the obvious and goes against what it was made for, but... Is there a way to use STunnel as a relay server w/o SSL? IOW, if you put STunnel in a number of installations but one or more PCs need a non-SSL server, can they use it? It would beat having to install "2" relay servers on each PC. -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

1 0

STunnel as a Relay server
by Thomas O'Hare 16 Sep '08

16 Sep '08

I know this is against what STunnel was made for but... There are Stunnel installations on client PCs but they also need to use STunnel to also send to non-SSL entities -- since it is easier then installing 2 relay/proxy servers. Is there a way to make STunnel into a non-SSL relay server? -- Thanks, ~ Thomas O'Hare ~ Web, Wireless, Network, Database & Systems Software/Hardware Operations Manager | Virtual FoxPro User Group Tom(a)VFUG.Org | http://www.VFUG.Org/

2 1

What is the difference between "all" and "SSLv3" for sslVersion?
by Christopher Hunt 14 Sep '08

14 Sep '08

Hi there, I would like to understand the difference between specifying an sslVersion of "all" vs "SSLv3" when I see that the client is attempting SSLv3. I have a Java 1.5 ssl client connecting to an stunnel endpoint. If I specify an sslVersion of "all" in my stunnel configuration then the client is able to connect. When I see it connect, it appears to have connected as SSLv3 i.e.: 2008.09.14 15:59:20 LOG7[98326:2690846624]: https accepted FD=12 from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: https started 2008.09.14 15:59:20 LOG7[98326:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:59:20 LOG7[98326:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:59:20 LOG7[98326:2952859648]: Waiting for a libwrap process 2008.09.14 15:59:20 LOG7[98326:2952859648]: Acquired libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Releasing libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: Released libwrap process #0 2008.09.14 15:59:20 LOG7[98326:2952859648]: https permitted by libwrap from 127.0.0.1:59812 2008.09.14 15:59:20 LOG5[98326:2952859648]: https accepted connection from 127.0.0.1:59812 2008.09.14 15:59:20 LOG7[98326:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:59:21 LOG7[98326:2952859648]: SSL state (accept): SSLv3 read client hello A etc. If I substitute "SSLv3" for the value of sslVersion then I get: 2008.09.14 15:56:26 LOG7[98297:2690846624]: https accepted FD=12 from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: https started 2008.09.14 15:56:26 LOG7[98297:2952859648]: FD 12 in non-blocking mode 2008.09.14 15:56:26 LOG7[98297:2952859648]: TCP_NODELAY option set on local socket 2008.09.14 15:56:26 LOG7[98297:2952859648]: Waiting for a libwrap process 2008.09.14 15:56:26 LOG7[98297:2952859648]: Acquired libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Releasing libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: Released libwrap process #0 2008.09.14 15:56:26 LOG7[98297:2952859648]: https permitted by libwrap from 127.0.0.1:59795 2008.09.14 15:56:26 LOG5[98297:2952859648]: https accepted connection from 127.0.0.1:59795 2008.09.14 15:56:26 LOG7[98297:2952859648]: SSL state (accept): before/ accept initialization 2008.09.14 15:56:27 LOG3[98297:2952859648]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried specifying "SSLv2" (client disconnected complaining that v2 was not supported) and "TLSv1" (yields the same error as "SSLv3". My version of stunnel is: stunnel 4.25 on i686-apple-darwin9.4.0 with OpenSSL 0.9.7l 28 Sep 2006 Thank you in advance for any explanation on the difference between "all" and "SSLv3". Kind regards, Christopher

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the session seems to have been negotiated okay. I found some notes about using "Run as administrator", but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting 128.221.79.49:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ipaddress]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Stunnel on Vista gets "readsocket: Connection reset by peer"
by Scarsdale_James＠emc.com 10 Sep '08

10 Sep '08

Hi, I'm trying to use stunnel 4.25 on Vista over the Microsoft Loopback Adapter, but I always get the following error shown next to ">>>" below. Note that the SSL session appears to have been negotiated okay. I found some notes about using "Run as adminstrator" on Vista, but I still get the same behavior with this. The same setup works fine on XP. Any ideas before I start looking at code? Thanks, Jim 2008.09.10 15:27:42 LOG7[2844:692]: RAND_status claims sufficient entropy for the PRNG 2008.09.10 15:27:42 LOG7[2844:692]: PRNG seeded successfully 2008.09.10 15:27:42 LOG7[2844:692]: Certificate: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Certificate loaded 2008.09.10 15:27:42 LOG7[2844:692]: Key file: stunnel.pem 2008.09.10 15:27:42 LOG7[2844:692]: Private key loaded 2008.09.10 15:27:42 LOG7[2844:692]: SSL context initialized for service smb 2008.09.10 15:27:42 LOG5[2844:692]: stunnel 4.25 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2008.09.10 15:27:42 LOG5[2844:692]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2008.09.10 15:27:42 LOG5[2844:2656]: No limit detected for the number of clients 2008.09.10 15:27:42 LOG7[2844:2656]: FD 248 in non-blocking mode 2008.09.10 15:27:42 LOG7[2844:2656]: SO_REUSEADDR option set on accept socket 2008.09.10 15:27:42 LOG7[2844:2656]: smb bound to 192.168.0.253:139 2008.09.10 15:28:13 LOG7[2844:2656]: smb accepted FD=240 from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2656]: Creating a new thread 2008.09.10 15:28:13 LOG7[2844:2656]: New thread created 2008.09.10 15:28:13 LOG7[2844:2856]: smb started 2008.09.10 15:28:13 LOG7[2844:2856]: FD 240 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on local socket 2008.09.10 15:28:13 LOG5[2844:2856]: smb accepted connection from 192.168.0.253:49238 2008.09.10 15:28:13 LOG7[2844:2856]: FD 264 in non-blocking mode 2008.09.10 15:28:13 LOG7[2844:2856]: smb connecting [server ip]:10005 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: waiting 10 seconds 2008.09.10 15:28:13 LOG7[2844:2856]: connect_wait: connected 2008.09.10 15:28:13 LOG5[2844:2856]: smb connected remote server from 128.221.79.44:49239 2008.09.10 15:28:13 LOG7[2844:2856]: Remote FD=264 initialized 2008.09.10 15:28:13 LOG7[2844:2856]: TCP_NODELAY option set on remote socket 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): before/connect initialization 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server hello A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server certificate A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read server done A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write client key exchange A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write change cipher spec A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 write finished A 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 flush data 2008.09.10 15:28:13 LOG7[2844:2856]: SSL state (connect): SSLv3 read finished A 2008.09.10 15:28:13 LOG7[2844:2856]: 1 items in the session cache 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects (SSL_connect()) 2008.09.10 15:28:13 LOG7[2844:2856]: 1 client connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 client renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects (SSL_accept()) 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server connects that finished 2008.09.10 15:28:13 LOG7[2844:2856]: 0 server renegotiations requested 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache hits 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache misses 2008.09.10 15:28:13 LOG7[2844:2856]: 0 session cache timeouts 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: SSL connected: new session negotiated 2008.09.10 15:28:13 LOG6[2844:2856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 >>> 2008.09.10 15:28:44 LOG3[2844:2856]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2008.09.10 15:28:44 LOG5[2844:2856]: Connection reset: 153 bytes sent to SSL, 0 bytes sent to socket 2008.09.10 15:28:44 LOG7[2844:2856]: smb finished (0 left) Relevant info stunnel.conf on client: [smb] accept = 192.168.0.253:139 connect = [server ip]:10005 Relevant info stunnel.conf on server: [smb] accept = 10005 connect = 139 ;connect = 445

1 0

Building STunnel 4.25 with OpenSSL 0.9.8h on Windows
by Paul Coleman 10 Sep '08

10 Sep '08

Hi everyone, I've recently been trying to compile STunnel for Windows, but have found so many conflicting reports of the best way to do it on the website / other sites, that I'm now well and truly confused! I've got MSVS 2005, but have also tried with mingw, and cygwin - and also on Linux using mingw32. I'm unsure as to whether I need some Makefile.w32, whether I need to compile OpenSSL from source, where I need to put OpenSSL libraries when they're done, if I need to run Configure, etc etc. I'm not looking for a complete step by step guide including 'cd to x, type this' (although I wouldn't complain! :P), but a general poke in the right direction would be great. Thanks for your help, --Paul

1 0

Re: [stunnel-users] Help using stunnel for the first time
by Jilin Zhang 09 Sep '08

09 Sep '08

try: http://localhost:1515 > Hi, > > I'm trying to use stunnel for the first time (on Mac OS X 10.5), and > I'm not having much luck. > > First of all, I downloaded the source and installed stunnel > successfully. I then setup a config file as follows (where myhost is > the host i am connecting to): > > client=yes > verify=0 > [psuedo-https] > accept=1515 > connect=myhost:443 > TIMEOUTclose = 0 > > Then, I run the following on the command line: > /usr/local/bin/stunnel ./stunnel.config > > It appears that stunnel runs without error, and if I do 'ps aux | grep > stunnel' there are 4 stunnel processes running. > > Then, as a test, I try to connect to port 1515 from my web browser by > visiting https://localhost:1515, but it just hangs there... nothing. > > Any suggestions? > > Thanks! > > Ian > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >

2 1

Help using stunnel for the first time
by Ian Baxter 09 Sep '08

09 Sep '08

Hi, I'm trying to use stunnel for the first time (on Mac OS X 10.5), and I'm not having much luck. First of all, I downloaded the source and installed stunnel successfully. I then setup a config file as follows (where myhost is the host i am connecting to): client=yes verify=0 [psuedo-https] accept=1515 connect=myhost:443 TIMEOUTclose = 0 Then, I run the following on the command line: /usr/local/bin/stunnel ./stunnel.config It appears that stunnel runs without error, and if I do 'ps aux | grep stunnel' there are 4 stunnel processes running. Then, as a test, I try to connect to port 1515 from my web browser by visiting https://localhost:1515, but it just hangs there... nothing. Any suggestions? Thanks! Ian

1 0

Re: [stunnel-users] A Calypso user needs your help with stunnel
by John Bryant 09 Sep '08

09 Sep '08

Dear Ludolf et al: Thank you very much for your recent communication. I drew up what I thought I needed, based on your answer, in the configuration file. As might be expected in that I'm a novice at this, I still have a few more questions: 1. I tried it with and without the "Authentification stuff". Either way, after modifying stunnel.conf, and running stunnel.exe, stunnel.exe bombed with the following error: "Stunnel server down" (log said: ************** 2008.09.02 14:20:17 LOG7[16442455:16274811]: RAND_status claims sufficient entropy for the PRNG 2008.09.02 14:20:17 LOG7[16442455:16274811]: PRNG seeded successfully 2008.09.02 14:20:17 LOG3[16442455:16274811]: Error loading verify certificates from certs.pem 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: B084002 : error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib 2008.09.02 14:20:17 LOG3[16442455:16274811]: error stack: 2006D080 : error:2006D080:BIO routines:BIO_new_file:no such file 2008.09.02 14:20:17 LOG3[16442455:16274811]: SSL_CTX_load_verify_locations: 2001002: error:02001002:system library:fopen:No such file or directory 2008.09.02 14:20:17 LOG3[16442455:16274811]: Server is down What caused this? ************** 2. My other question is: Do I need to put stunnel.exe in the startup folder? Does it automatically reference stunnel.conf (that is what I was assuming)? When I get it to run correctly, automatically referencing stunnel, conf, then can I run Calypso with the settings changed to tie in with the stunnel conf file? All of the above I was assuming was true, but I'm just asking to make sure. Thanks! Lenny

3 6

Respawn stunnel
by Joe Kemp 08 Sep '08

08 Sep '08

What is the best way to setup stunnel to respawn if it crashes? I have looked at inittab (probably would have to have stunnel run in foreground?) or the procautostart.cpp utility. Any other ideas? Is there an easier way. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Christopher Hunt 04 Sep '08

04 Sep '08

On 04/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Here is my plist. I put this in /Library/LaunchDaemons. What do you > think? --Thanks, Allen Firstly have you considered using Lingon to maintain your plist? That could help you. > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd > "> > <plist version="1.0"> > <dict> > <key>KeepAlive</key> > <true/> > <key>Label</key> > <string>stunnel_startup</string> > <key>ProgramArguments</key> > <array> > <string>/opt/local/bin/stunnel</string> > </array> > <key>RunAtLoad</key> > <true/> > </dict> > </plist> The most obvious thing that stands out is that you aren't supplying a config file argument to stunnel. How's it going to locate your config file? You might want to check your system.log file using the Console application and watch for messages. You also need to use launchctl to load your plist - Lingon makes this pretty straightforward. Cheers, -C

1 0

Scripting stunnel to load automatically when OS X 10.5 server starts up -plist
by Allen 03 Sep '08

03 Sep '08

Thank you Chris and Tom, for your responses, Here is my plist. I put this in /Library/LaunchDaemons. What do you think? --Thanks, Allen <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd "> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>stunnel_startup</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/stunnel</string> </array> <key>RunAtLoad</key> <true/> </dict> </plist>

1 1

Re: [stunnel-users] Scripting stunnel to load automatically when OS X 10.5 server starts up -any solution?
by Christopher Hunt 03 Sep '08

03 Sep '08

On 03/09/2008, at 8:00 PM, stunnel-users-request(a)mirt.net wrote: > Does anybody have a solution that will start up stunnel on OS X > bootup? ... Sounds to me like a launchd config error. How about sending through the plist? Cheers, -C

2 1

Starting stunnel automatically on OS X system startup
by Allen 02 Sep '08

02 Sep '08

Does anybody have a solution that will start up stunnel on OS X bootup? I've installed stunnel on a Leopard server (OS 10.4.5.4) to make a smtp SSL relay work (and it works fine). The problem is, we'd have to type in /opt/local/bin/stunnel on the command line every time the server is rebooted. Rather than having to create a /Library/ SystemStartup/diretory_structure_with_plist_etc., has somebody done this, and can lead me in the right direction, in the interest of time? I've just run out of time, and I kinda think that somebody must have done this already. Thanks! Allen

1 1

A Calypso user needs your help with stunnel
by John Bryant 02 Sep '08

02 Sep '08

Dear folks: I am trying to install stunnel so that I can have an SSL capability with Calypso. I was guided to the stunnel.org site by instructions at: http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-…. (the instructions that I am referring to are duplicated below, under the first line of asterisks - they mention later versions of stunnel, but do not update their instructions for them adequately) I could not understand the instructions at your site that told about modifying the conf file with the LATEST version of stunnel.exe, which I did download and install and that's as far as I got - couldn't understand the options as clearly as I had the others, so uninstalled it.) (Tried downloading the OLD version, 4.05 exe, mentioned in the instructions and the two dll files,and making all the changes to THAT conf.txt file, etc, but THAT did not work because when I ran the shortcut to the conf.txt file that I had put in the Start folder, the computer gave me, when connected, a "cannot find 1 1/4 dll" message, and then an "illegal op" and a "cannot run due to restrictions on your computer" message (when not connected, just the latter two). I know you don't want to hear about old versions but it was logical for me to try since I could not figure out how to use the latest version.) So what do I do now? Thanks! Lenora (do not give up on me, I have computers in my background, etc. etc) ************** (Excerpts from the thread at the url listed above) http://www.windowsbbs.com/courier-email-client/35188-ssl-connection-really-… A week ago I provided instructions for using stunnel to provide SSL functionality for Calypso/Courier - in case your email provider requires SSL, which Calypso and Courier do not yet support. Those instructions were correct if your email provider uses the dedicated SSL ports - 465 for smtps, 995 for pop3s, 993 for imap4s. They were incomplete if your email provider uses the standard ports - 25 for smtp, 110 for pop3, [N/A - 143 for imap4]. Normally when the SSL ports are being used the entire conversation is encrypted with SSL. stunnel will initiate the session with the standard SSL protocol. However, if the standard ports are being used the session is initiated without SSL and then switches to SSL using an smtp or pop3 specific protocol (STARTTLS or STLS). stunnel needs to be told this, or it wont work on the standard ports. For the standard ports an extra line is required in the configuration file. To use stunnel do the following: 1) download the following files from http://www.stunnel.org/download/binaries.html stunnel-4.05.exe (version may be higher when you go there) libssl32.dll libeay32.dll and put them into a directory such as C:\Program Files\Stunnel\ 2) create a shortcut to stunnel-4.05.exe in the same directory [in WinXP do this by right clicking on it and selecting Create Shortcut] 3) edit the shortcut by right clicking on it and selecting Properties Modify the Target to look like this "C:\Program Files\Stunnel\stunnel-4.05.exe" stunnel-conf.txt (Optional) Rename the shortcut to remove the "Shortcut to ". 4) create the file stunnel-conf.txt in the same directory, and put the following lines in it: ----starting with next line---- # GLOBAL OPTIONS client = yes output = stunnel-log.txt debug=4 taskbar = yes # SERVICE-LEVEL OPTIONS [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:995 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:465 ----ending with previous line---- Change the server names (before colons), and perhaps ports (after colons), to be correct for your ISP. Change ISP name too. Save and exit. 4b) if your email provider uses standard ports for either smtp or pop3, make either or both of the following changes to your stunnel-conf.txt file: [POP3 (ISP name)] accept = 127.0.0.1:108 connect = myISPs.POP3server.net:110 protocol = pop3 [SMTP (ISP name)] accept = 127.0.0.1:107 connect = myISPs.SMTPserver.net:25 protocol = smtp Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 4c) if you have two email providers requiring SSL you can add a second set of services like so: [POP3 (2nd ISP name)] accept = 127.0.0.1:106 connect = my2ndISPs.POP3server.net:995 [SMTP (2nd ISP name)] accept = 127.0.0.1:105 connect = my2ndISPs.SMTPserver.net:465 Each email provider requires its own two ports (e.g. 108+107, 106+105), but 2 email accounts at a single provider can share the same pair of ports. However, if an email provider only uses SSL for one of smtp or pop3, you only need one of the two service sections. Once again, change the server names (before colons) to be correct for your ISP. Change ISP name too. Save and exit. 5) put a copy of that shortcut into your Start Menu's Programs/Startup folder [normally, by dragging shortcut over Start button, over Programs, over Startup, then drop it in Startup list.] 6) edit your Calypso/Courier Account Properties to change your mail servers. Incoming: Port 108 Server 127.0.0.1 Outgoing: Port 107 Server 127.0.0.1 [this is done differently for Calypso and Courier, due to Courier's new approach to SMTP servers] If an email provider only uses SSL for one of smtp or pop3, you only need to change one of the two mail servers. If you set up more than one email provider for SSL, change each account's properties to the corresponding ports. Now when you check or send email Calypso/Courier will communicate with stunnel, which will connect to your ISP's mail servers via SSL. The shortcut in Startup will rerun stunnel each time you reboot. You should just double-click on the shortcut in the program folder to run stunnel the first time. Hope this helps. Greg ************* Later addition (later on same thread): I just reinstalled all of my computer and I forgot to backup my sTunnel config! Anyway, the instructions have changed a bit as of sTunnel version 4.12... sTunnel is now distributed as an installer EXE, and the auxiliary DLLs are installed by default. The only step that really changes is step 1. All you have to do is to download the sTunnel installer and run it. There is no need to download the other files. The rest stays pretty much the same. ********** Question from somebody: First of all, I want to thank you for posting this very useful 'how to' -- this is what foruming is all about I have two questions (for anyone): 1. When using Stunnel, does it completely encrypt the user name, password, and the contents of the email, or just the contents? 2. The Stunnel website (www.stunnel.org) mentions that you'd also need the OpenSSL Libraries to make it work. But I did not download them, and still managed to make the Stunnel work with Courier. Am I (still) missing something? ************ Answer: 1. stunnel establishes an ssl tunnel (hence the name) between your computer and the email server. So every byte travelling between the two is encrypted. It's like establishing a VPN between your computer and the server. 2. As gmagana posted at the start of the month, they seem to have enhanced the installation process - such that you don't need to worry about the extra files. Isn't open source great! ********* Final comment: Looks like I can finally use Courier with Google's Gmail (http://gmail.google.com) to send/receive encrypted email. (End of excerpts)

2 1

Re: [stunnel-users] failed to build stunnel 4.25 under VS 2005
by Michal Trojnara 29 Aug '08

29 Aug '08

On Fri, 29 Aug 2008 00:00:56 +0800, "Ericdai" <pcix133(a)hotmail.com> wrote: > I try to build Stunnel 4.25 under VS2005 ,but failed Today I updated stunnel, so it can be built with Visual C++ 2008 (known also as Visual C++ 9.0). My plan is to release stunnel 4.26 next week. > prototypes.h(428) : error C2081: 'socklen_t' : name in formal > parameter list illegal I had no problem with socklen_t. Maybe it's specific to the old version of Visual C++. > I also suggest build a windows client only version > n It only can be running on windows > n It only can act as a client > n I think it can reduce the code size and runtime footprice smaller Not really. The difference would be negligible. Best regards, Mike

1 0

failed to build stunnel 4.25 under VS 2005
by Ericdai 28 Aug '08

28 Aug '08

I try to build Stunnel 4.25 under VS2005 ,but failed cl -MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo -I"..\..\ssl\inc32" -DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO -DHAVE_GETNAMEINFO -D_MBCS /c stunnel.c stunnel.c prototypes.h(428) : error C2081: 'socklen_t' : name in formal parameter list illegal stunnel.c(206) : error C2065: 'socklen_t' : undeclared identifier stunnel.c(206) : error C2146: syntax error : missing ';' before identifier 'addrlen' stunnel.c(206) : error C2065: 'addrlen' : undeclared identifier I use nmake -f vc.mak to do it Anyone has build it successfully ,pls help me ! Another way ,is there a stunnel solution or project file ? I also suggest build a windows client only version n It only can be running on windows n It only can act as a client n I think it can reduce the code size and runtime footprice smaller Thanks and best regards Eric dai

1 0

Re: [stunnel-users] In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Friday 22 August 2008 you wrote: > I noticed that when running stunnel from within the jail it logs its > messages with syslong using UTC. > > My question is how would one reconcile timezone of chrooted stunnel with a > system one? > > The issue illustrated: > > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on > i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD > SSL:ENGINE Sockets:POLL,IPv4 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients > allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 > connected from 127.0.0.1:1469 > Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: > depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet > > xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in > chrooted environment and thus uses UTC (if it's not chrooted it reports > localtime to syslog facility). > > Any ideas? Jee that was simple! cp /etc/localtime /var/lib/stunnel/etc/ (on each machine where stunnel runs) and you're done :^) -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

I noticed that when running stunnel from within the jail it logs its messages with syslong using UTC. My question is how would one reconcile timezone of chrooted stunnel with a system one? The issue illustrated: Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 connected from 127.0.0.1:1469 Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in chrooted environment and thus uses UTC (if it's not chrooted it reports localtime to syslog facility). Any ideas? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1