- stunnel-users - stunnel.org

Re: [stunnel-users] STARTTLS
by James Devine 20 Jan '12

20 Jan '12

http and smtp are two different birds, https runs on a different port, whereas an smtp connection running on port 25 can be upgraded to secure with starttls On Fri, Jan 20, 2012 at 12:29 AM, Michal Trojnara <Michal.Trojnara(a)mirt.net>wrote: > James Devine <fxmulder(a)gmail.com> wrote: > > >I've setup stunnel to tunnel port 25 to a few backend smtp servers, it > >appears that it only works with starttls, is there a way to make it > >work if > >no starttls is issued also? > >_______________________________________________ > >stunnel-users mailing list > >stunnel-users(a)stunnel.org > >http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > Do you also have problems with https on port 80? > > Mike >

1 0

STARTTLS
by James Devine 19 Jan '12

19 Jan '12

I've setup stunnel to tunnel port 25 to a few backend smtp servers, it appears that it only works with starttls, is there a way to make it work if no starttls is issued also?

1 0

ver 4.5 VS 4.2: running single process now, how to close when all client apps closed?
by larisa_y 19 Jan '12

19 Jan '12

I have several client applications running on win machine, connecting to the same server, or sometimes to different servers. ver. 4.2 allowed me to do the following: modify .conf file to [my_section] accept=5566 connect 123.22.33.44:5005; then run stunnel.exe; modify .conf file to [my_section] accept=5567 connect 456.22.33.44:5006; then run stunnel.exe. That would start 2 stunnel.exe processes, each one handling its own connection; which were easy to close when each respective client app closed - each one would close the one it started. Now with 4.5 version: the single stunnel.exe process runs and is able to handle all communications perfectly, provided I prepare .conf file for all possible connections in advance, before starting stunnel. The problem I cannot solve easily is how not to leave stunnel running after client logged out of all the applications. Without building something to keep track of "stunnels users" count, how could I do it? Is there some way to switch to multiple instances mode? Please advise. Larisa -- View this message in context: http://old.nabble.com/ver-4.5-VS-4.2%3A-running-single-process-now%2C-how-t… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 7

Windows Live Mail issue ?
by Victor 19 Jan '12

19 Jan '12

I'm new with stunnel and I'm experiencing a issue. Windows Live Mail is closing the connection with the SSL tunnel without send the close down packet, resulting in connection reset by peer. Follow the output debug of stunnel: 2012.01.18 17:13:25 LOG7[16954:34377572800]: Socket closed on read 2012.01.18 17:13:25 LOG7[16954:34377572800]: Sending SSL write shutdown 2012.01.18 17:13:25 LOG7[16954:34377572800]: SSL alert (write): warning: close notify 2012.01.18 17:13:25 LOG6[16954:34377572800]: SSL_shutdown successfully sent close_notify 2012.01.18 17:13:25 LOG3[16954:34377572800]: SSL_read: Connection reset by peer (54) 2012.01.18 17:13:25 LOG5[16954:34377572800]: Connection reset: 293 bytes sent to SSL, 1293 bytes sent to socket 2012.01.18 17:13:25 LOG7[16954:34377572800]: Service stunnel finished (0 left) 2012.01.18 17:13:25 LOG7[16954:34377572800]: str_stats: 28 block(s), 988 byte(s) The e-mail message is sent successfully but Im very intrigued with the line "Connection reset: 293 bytes sent to SSL, 1293 bytes sent to socket", that make me think that some data was lost in the middle of the connection. I need to fix something or this is a normal behavior ? qmail 1.03 with SPAMCONTROL stunnel 4.43 running on FreeBSD 8.0-RELEASE Config file: ; SMTP SSL (SMTP-AUTH) debug = 7 foreground = yes syslog = no cert = /usr/local/etc/stunnel/stunnel.pem exec = /var/qmail/bin/qmail-smtpd execargs = qmail-smtpd /mailhome/bin/vchkpw /bin/true Thanks in advance !

2 1

client side SNI
by yyy 14 Jan '12

14 Jan '12

It looks like server name for client side SNI is defined as name to connect to in connect option. According to RFC, this name must be FQDN. It is the only place where it is defined and server name for SNI cannot be defined outside connect option. Is that right? Server side SNI has some good examples. Searching for "client side SNI" did not yield anything useful. I am trying to run multiple independent services over the same port there is no DNS infrastructure in place, so those server names would be random strings not refering to anything. Both ends would be stunnel. If it is as it seems, it will not work, because defined server name (at client) must be working DNS name (FQDN).

2 7

Verify = 3 and Giganews
by Thomas Eifert 13 Jan '12

13 Jan '12

Hello, I've tried to use verify = 3 with Giganews on several occasions now, but it always fails. It works fine with other servers, however. Here is the debug output for the Giganews scenario: 2012.01.12 14:05:01 LOG4[292:3840]: CERT: Verification error: unable to get local issuer certificate 2012.01.12 14:05:01 LOG4[292:3840]: Certificate check failed: depth=1, /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA 2012.01.12 14:05:01 LOG3[292:3840]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed And the following is from my stunnel.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ debug = 6 delay = yes [nntps.3] client = yes sslVersion = TLSv1 ciphers = AES256-SHA cafile = peer-nntps.3.pem verify = 3 accept = 127.0.0.1:119 connect = news.giganews.com:443 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ As I have with other connections, I am saving peer-nntps3.pem from the log window menu. Can anyone tell me why this is failing on this server only? Regards; Thomas

2 2

stunnel 4.52 released
by Michal Trojnara 12 Jan '12

12 Jan '12

Dear Users, I have released version 4.52 of stunnel. This is a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.52, 2012.01.12, urgency: MEDIUM: * Bugfixes - Fixed write closure notification for non-socket file descriptors. - Removed a line logged to stderr in inetd mode. - Fixed "Socket operation on non-socket" error in inetd mode on Mac OS X platform. - Removed direct access to the fields of the X509_STORE_CTX data structure. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.52.tar.gz: 7c78c178074e9b96331518a9c309d2e95ca9ad6e0338a96d5ab8ad47fde4347c Best regards, Mike

1 0

fips=no and slow performance problem
by Owen Ching 12 Jan '12

12 Jan '12

I have a production system that uses stunnel and it's been working pretty well. Mike, thanks for all your hard work. But there has been a weird issue that I ran into a while ago and now it's happening again. we're using a rackspace cloud machine to run stunnel and haproxy. we're using the x-forwarded-for stunnel patch for now with plans to upgrade to send-proxy method once haproxy 1.5 is considered the stable branch. So I built one machine and ran into the "FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match" error message. So I changed the config to fips=no and stunnel started up but the https seems really slow (multiple browsers). We run with significant https volume. So the fips=no option didn't work for us. I kept trying different things but nothing worked. I decided to start clean and built a new machine. This time stunnel didn't throw the FIPS error and everything performed great. So used the new machine instead. Now after some time (over a year), we had some performance problems. we rebooted the machine and now we have the FIPS error again. I've tried multiple versions of stunnel (whatever I could find working patches for) and also tried a clean 4.51 with no patches. all of them throw the FIPS error now on this machine. I'm in the process of building a new machine to see if it magically works again. Any help or insight would be greatly appreciated. Thanks, Owen

2 2

I am having problems with the 4.5x-series also: Pan connects, nothing else happens.
by SciFi 12 Jan '12

12 Jan '12

Hi, I am also having no luck using the stunnel-4.5* series. The last/latest working for me is 4.49. $ uname -a Darwin SciFi.homeip.net 10.8.0 Darwin Kernel Version 10.8.0: Tue Jun 7 16:33:36 PDT 2011; root:xnu-1504.15.3~1/RELEASE_I386 i386 i386 iMac6,1 Darwin (altho this is a C2D machine, running most tasks in 64-bit mode, Apple has left the EFI/BIOS/kernels at 32-bit… yes I can boot+run 10.7/Lion, but that is a total separate topic altogether [don't get me started]…) I mainly use stunnel with Pan, to connect to Giganews, Astraweb, and Gmane (which is what I'm using now to post this message). I use the simple 127.0.0.1:port mechanism. (I've been working with one of Pan's new developers, to try their new GnuTLS support; but until that works, stunnel is my known supposedly-functioning fallback.) I've tested every 4.5x release, including today's 4.52b1 & b2 -- all act the same, in that Pan tries to connect to stunnel, and that's all I see, nothing further happens. Also, the 4.5-series produces much-less log-listing, as you'll see in my attachments below. I am fine while relegated to using stunnel-4.49, but we have a further issue, in that the "verify=<number>" option seems to reject the certs & what-not coming from these servers, for any <number> higher than 0 (yes I saw the maillist discussion about what 4 means there, and tried it also). I've been mildly joking with the Pan developer on how to be sure we are /really/ in secure mode. ;) Now, the details. I manually start stunnel on a login-root terminal window, this way: # stunnel /usr/local/etc/stunnel/stunnel.conf -sockets With these sample log-lists (below), I'm trying to get one single short post in a newsgroup. I made sure Pan did not save this post in its cache, such that it does try to fetch the post from the NNTP server. (Currently, Pan is set to use Astraweb as my primary feed.) Here's what 4.49 will show on the terminal (this works: I can see the modem blinking, and can see/read the post): ---start--- 2012.01.11 10:24:51 LOG7[3782:2697274688]: Clients allowed=500 2012.01.11 10:24:51 LOG7[3782:2697274688]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.01.11 10:24:51 LOG7[3782:2697274688]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.01.11 10:24:51 LOG5[3782:2697274688]: stunnel 4.49 on i386-apple-darwin10.8.0 platform 2012.01.11 10:24:51 LOG5[3782:2697274688]: Compiled/running with OpenSSL 1.1.0-dev xx XXX xxxx 2012.01.11 10:24:51 LOG5[3782:2697274688]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:SELECT,IPv6 2012.01.11 10:24:51 LOG5[3782:2697274688]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.01.11 10:24:51 LOG6[3782:2697274688]: Compression enabled using zlib method 2012.01.11 10:24:51 LOG7[3782:2697274688]: PRNG seeded successfully 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_gn 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_aw 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_gm 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG5[3782:2697274688]: Configuration successful 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=5 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=6 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=6 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=8 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=8 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=9 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=9 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=10 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=10 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=11 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=11 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gn bound to 0.0.0.0:12000 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gn opened FD=11 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=12 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_aw bound to 0.0.0.0:12001 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_aw opened FD=12 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=13 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gm bound to 0.0.0.0:12002 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gm opened FD=13 2012.01.11 10:24:52 LOG7[3782:2697274688]: Created pid file /stunnel.pid 2012.01.11 10:25:53 LOG7[3782:2697274688]: local socket: FD=14 allocated (non-blocking mode) 2012.01.11 10:25:53 LOG7[3782:2697274688]: Service nntp_aw accepted FD=14 from 127.0.0.1:52241 2012.01.11 10:25:53 LOG7[3782:2952859648]: Service nntp_aw started 2012.01.11 10:25:53 LOG7[3782:2952859648]: Option TCP_NODELAY set on local socket 2012.01.11 10:25:53 LOG7[3782:2952859648]: Waiting for a libwrap process 2012.01.11 10:25:53 LOG7[3782:2952859648]: Acquired libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Releasing libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Released libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Service nntp_aw permitted by libwrap from 127.0.0.1:52241 2012.01.11 10:25:53 LOG5[3782:2952859648]: Service nntp_aw accepted connection from 127.0.0.1:52241 2012.01.11 10:25:53 LOG7[3782:2952859648]: remote socket: FD=15 allocated (non-blocking mode) 2012.01.11 10:25:53 LOG6[3782:2952859648]: connect_blocking: connecting 216.151.153.83:563 2012.01.11 10:25:53 LOG7[3782:2952859648]: connect_blocking: s_poll_wait 216.151.153.83:563: waiting 10 seconds 2012.01.11 10:25:54 LOG5[3782:2952859648]: connect_blocking: connected 216.151.153.83:563 2012.01.11 10:25:54 LOG5[3782:2952859648]: Service nntp_aw connected remote server from 192.168.1.65:52242 2012.01.11 10:25:54 LOG7[3782:2952859648]: Remote FD=15 initialized 2012.01.11 10:25:54 LOG7[3782:2952859648]: Option TCP_NODELAY set on remote socket 2012.01.11 10:25:54 LOG7[3782:2952859648]: SNI: host name: ssl.astraweb.com 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=3, /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=3, /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//emailAddress=info@valicert.com 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=2, /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=2, /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=1, /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=1, /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=0, /O=*.astraweb.com/OU=Domain Control Validated/CN=*.astraweb.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=0, /O=*.astraweb.com/OU=Domain Control Validated/CN=*.astraweb.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: SSL connected: new session negotiated 2012.01.11 10:25:54 LOG6[3782:2952859648]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2012.01.11 10:26:06 LOG7[3782:2952859648]: Socket closed on read 2012.01.11 10:26:06 LOG7[3782:2952859648]: Sending SSL write shutdown 2012.01.11 10:26:06 LOG6[3782:2952859648]: SSL_shutdown successfully sent close_notify 2012.01.11 10:26:06 LOG3[3782:2952859648]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.01.11 10:26:06 LOG5[3782:2952859648]: Connection closed: 147 bytes sent to SSL, 1446 bytes sent to socket 2012.01.11 10:26:06 LOG7[3782:2952859648]: Service nntp_aw finished (0 left) 2012.01.11 10:26:06 LOG7[3782:2952859648]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) ^C2012.01.11 10:26:11 LOG7[3782:2697274688]: Dispatching signals from the signal pipe 2012.01.11 10:26:11 LOG3[3782:2697274688]: Received signal 2; terminating 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_gn closed FD=11 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_aw closed FD=12 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_gm closed FD=13 2012.01.11 10:26:11 LOG7[3782:2697274688]: str_stats: 76 block(s), 4835 data byte(s), 2584 control byte(s) 2012.01.11 10:26:11 LOG7[3782:2697274688]: removing pid file /stunnel.pid # _ ---end--- Here's what 4.52b2 shows, much like other 4.5x versions (note it shows much-less than 4.49) -- Pan tried to connect starting at 10:21:27, timing-out twice at least, before I made it go off-line etc.: ---start--- 2012.01.11 10:20:22 LOG7[3549:3146608]: Clients allowed=500 2012.01.11 10:20:22 LOG5[3549:3146608]: stunnel 4.52 on x86_64-apple-darwin10.8.0 platform 2012.01.11 10:20:22 LOG5[3549:3146608]: Compiled/running with OpenSSL 1.1.0-dev xx XXX xxxx 2012.01.11 10:20:22 LOG5[3549:3146608]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:SELECT,IPv6 2012.01.11 10:20:22 LOG5[3549:3146608]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.01.11 10:20:22 LOG6[3549:3146608]: Compression enabled: 2 algorithm(s) 2012.01.11 10:20:22 LOG7[3549:3146608]: PRNG seeded successfully 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_gn 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_aw 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_gm 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG5[3549:3146608]: Configuration successful 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_gn bound FD=13 to 0.0.0.0:12000 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_aw bound FD=14 to 0.0.0.0:12001 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_gm bound FD=15 to 0.0.0.0:12002 2012.01.11 10:20:23 LOG7[3549:3146608]: Created pid file /stunnel.pid 2012.01.11 10:21:27 LOG7[3549:3146608]: Service nntp_aw accepted FD=16 from 127.0.0.1:52237 2012.01.11 10:22:01 LOG7[3549:3146608]: Service nntp_aw accepted FD=17 from 127.0.0.1:52238 ^C2012.01.11 10:22:32 LOG7[3549:3146608]: Dispatching signals from the signal pipe 2012.01.11 10:22:32 LOG3[3549:3146608]: Received signal 2; terminating 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_gn closed FD=13 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_aw closed FD=14 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_gm closed FD=15 2012.01.11 10:22:32 LOG7[3549:3146608]: str_stats: 55 block(s), 4163 data byte(s), 1870 control byte(s) 2012.01.11 10:22:32 LOG7[3549:3146608]: removing pid file /stunnel.pid # _ ---end--- Here's my stunnel.conf with superfluous comments removed: ---/usr/local/etc/stunnel/stunnel.conf--- foreground = yes key = /usr/local/etc/stunnel/stunnel.pem sslVersion = all ciphers = ALL chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid compression = zlib verify = 0 CApath = /certs CRLpath = /crls debug = 7 client = yes TIMEOUTclose = 0 ; service-level configuration [nntp_gn] accept = 12000 connect = news.giganews.com:563 [nntp_aw] accept = 12001 connect = ssl.astraweb.com:563 [nntp_gm] accept = 12002 connect = 80.91.229.10:563 ; vim:ft=dosini ---end--- To generate the aforementioned stunnel.pem, I followed the steps shown here: <https://baltazaar.wordpress.com/2008/03/03/configuring-pan-newsreader-with-…> Here is my build-log for 4.52b2, similar to my other builds: ---start--- $ cat ./dothis.sh # ./configure \ --enable-dependency-tracking \ --enable-static \ --enable-shared \ --enable-ipv6 \ --with-ssl=/usr/local/ssl \ # $ ./dothis.sh configure: **************************************** initialization checking for a BSD-compatible install... /usr/local/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /usr/local/bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... x86_64-apple-darwin10.8.0 checking host system type... x86_64-apple-darwin10.8.0 checking for gcc... gcc-4.2 checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc-4.2 accepts -g... yes checking for gcc-4.2 option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc-4.2... gcc3 checking whether gcc-4.2 and cc understand -c and -o together... yes checking whether make sets $(MAKE)... (cached) yes configure: **************************************** compiler/linker flags checking whether gcc-4.2 accepts -pthread... yes checking whether gcc-4.2 accepts -fstack-protector... yes checking whether gcc-4.2 accepts -Wall... yes checking whether gcc-4.2 accepts -Wextra... yes checking whether gcc-4.2 accepts -Wno-long-long... yes checking whether gcc-4.2 accepts -pedantic... yes configure: **************************************** libtool checking for a sed that does not truncate output... /usr/local/bin/sed checking for grep that handles long lines and -e... /usr/local/bin/grep checking for egrep... /usr/local/bin/grep -E checking for fgrep... /usr/local/bin/grep -F checking for ld used by gcc-4.2... /usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld checking if the linker (/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld) is GNU ld... no checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm checking the name lister (/usr/bin/nm) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 196608 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking for /usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld option to reload object files... -r checking for objdump... no checking how to recognize dependent libraries... pass_all checking for ar... ar checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm output from gcc-4.2 object... ok checking for dsymutil... dsymutil checking for nmedit... nmedit checking for lipo... lipo checking for otool... otool checking for otool64... no checking for -single_module linker flag... yes checking for -exported_symbols_list linker flag... yes checking how to run the C preprocessor... cpp-4.2 checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc-4.2 supports -fno-rtti -fno-exceptions... no checking for gcc-4.2 option to produce PIC... -fno-common -DPIC checking if gcc-4.2 PIC flag -fno-common -DPIC works... yes checking if gcc-4.2 static flag -static works... no checking if gcc-4.2 supports -c -o file.o... yes checking if gcc-4.2 supports -c -o file.o... (cached) yes checking whether the gcc-4.2 linker (/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld) supports shared libraries... yes checking dynamic linker characteristics... darwin10.8.0 dyld checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: **************************************** types checking size of unsigned char... 1 checking size of unsigned short... 2 checking size of unsigned int... 4 checking size of unsigned long... 4 checking for socklen_t... yes checking for struct sockaddr_un... yes checking for struct addrinfo... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no configure: **************************************** entropy sources checking for "/dev/urandom"... yes configure: **************************************** default group checking for default group... nogroup configure: **************************************** header files checking ucontext.h usability... no checking ucontext.h presence... no checking for ucontext.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking stropts.h usability... no checking stropts.h presence... no checking for stropts.h... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... yes checking util.h presence... yes checking for util.h... yes checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for struct msghdr.msg_control... yes checking for linux/netfilter_ipv4.h... no configure: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... none required checking for library containing socket... none required checking for library containing openpty... none required checking for library containing dlopen... none required checking for library containing shl_load... no checking for library containing inflateEnd... -lz configure: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lc... yes checking for pthread_create in -lpthread... yes configure: PTHREAD thread model detected configure: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... yes checking for __makecontext_v2... no checking for poll... yes checking for gethostbyname2... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... yes (poll() disabled) checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... yes checking whether to enable FIPS mode support... autodetecting configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking for FIPS_mode_set... no configure: **************************************** write the results configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: creating tools/stunnel.service config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success $ make -w make: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' Making all in src make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make all-am make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' /bin/sh ../libtool --tag=CC --mode=compile gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o libtool: compile: gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -o env.o >/dev/null 2>&1 mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc-4.2 -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib -lpthread -lwrap libtool: link: gcc-4.2 -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib /usr/local/lib/libpthread.dylib -lwrap -mtune=core2 -march=core2 -arch i386 -mtune=core2 -march=core2 -arch i386 -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module libtool: link: dsymutil .libs/libstunnel.dylib || : warning: no debug symbols in executable (-arch i386) libtool: link: ar cru .libs/libstunnel.a env.o libtool: link: ranlib .libs/libstunnel.a libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘daemonize’: stunnel.c:459: warning: ‘daemon’ is deprecated (declared at /usr/include/stdlib.h:289) mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc-4.2 -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib -lpthread -lwrap libtool: link: gcc-4.2 -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib /usr/local/lib/libpthread.dylib -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' Making all in doc make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' Making all in tools make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' $ sudo make -w install Password: make: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' Making install in src make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' test -z "/usr/local/bin" || /usr/local/bin/mkdir -p "/usr/local/bin" /bin/sh ../libtool --mode=install /usr/local/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/local/bin/install -c stunnel /usr/local/bin/stunnel test -z "/usr/local/bin" || /usr/local/bin/mkdir -p "/usr/local/bin" /usr/local/bin/install -c stunnel3 '/usr/local/bin' test -z "/usr/local/lib/stunnel" || /usr/local/bin/mkdir -p "/usr/local/lib/stunnel" /bin/sh ../libtool --mode=install /usr/local/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/local/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/local/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la libtool: install: /usr/local/bin/install -c .libs/libstunnel.a /usr/local/lib/stunnel/libstunnel.a libtool: install: chmod 644 /usr/local/lib/stunnel/libstunnel.a libtool: install: ranlib /usr/local/lib/stunnel/libstunnel.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/stunnel If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable during execution See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' Making install in doc make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/share/doc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel" /usr/local/bin/install -c -m 644 stunnel.html stunnel.pl.html stunnel.fr.html '/usr/local/share/doc/stunnel' test -z "/usr/local/share/man/man8" || /usr/local/bin/mkdir -p "/usr/local/share/man/man8" /usr/local/bin/install -c -m 644 stunnel.8 stunnel.pl.8 stunnel.fr.8 '/usr/local/share/man/man8' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' Making install in tools make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/etc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/etc/stunnel" /usr/local/bin/install -c -m 644 stunnel.conf-sample '/usr/local/etc/stunnel' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/ssl/bin/openssl req -new -x509 -days 365 $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ /usr/local/ssl/bin/openssl gendh $RND 1024 >> stunnel.pem; \ /usr/local/ssl/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ /usr/local/bin/install -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi /usr/local/bin/install -c -d -m 1770 /usr/local/var/lib/stunnel chgrp nogroup /usr/local/var/lib/stunnel if uname | grep SunOS; then \ /usr/local/bin/install -c -d -m 755 /usr/local/var/lib/stunnel/dev; \ mknod /usr/local/var/lib/stunnel/dev/zero c 13 12; \ chmod 666 /usr/local/var/lib/stunnel/dev/zero; \ fi test -z "/usr/local/share/doc/stunnel/examples" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel/examples" /usr/local/bin/install -c -m 644 ca.html ca.pl importCA.html importCA.sh script.sh stunnel.spec stunnel.init stunnel.service '/usr/local/share/doc/stunnel/examples' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/share/doc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel" /usr/local/bin/install -c -m 644 INSTALL README TODO COPYING AUTHORS ChangeLog PORTS BUGS COPYRIGHT.GPL CREDITS INSTALL.W32 INSTALL.WCE INSTALL.FIPS '/usr/local/share/doc/stunnel' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' $ _ ---end--- If it matters, I have a local checkout of the openssl-cvs repo here, and use it instead-of Apple's. [BTW I have a personal project to "jump off this fruity ship" ASAP. I've written about this in earlier posts (several months ago) to the Pan maillist, if anyone is interested.] Thanks for any help at all. --

2 3

Re: [stunnel-users] Stunnel 4.33 last one to work with VM & IMAP
by Michal Trojnara 11 Jan '12

11 Jan '12

Mark Wogahn wrote: > No joy here. The thing that bugs me the most about this problem is > why do stunnel versions after 4.33 work on linux and bsd but not Mac > OS? It looks like Apple has put some serious effort to make its TCP/IP stack incompatible with other operating systems. Here is the the version I successfully tested against Mac OS X 10.5.8 (PowerPC): ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.52b2.tar.gz Mike

1 0