- stunnel-users - stunnel.org

RFC: purge use of keyword 'transparent'
by oscaruser＠programmer.net 08 Jan '11

08 Jan '11

Folks, After searching, installing various Linuces (in the 2.6 family), e.g. CentOS, Ubuntu, and so on, I have not been able to get transparent proxy working at all. As such since it the function does not work, and there is great debate as to whether it ever worked, I would like to propose that this keyword and reference to its function be discarded entirely. This will save many folks a great deal of time and effort attempting to try and get it to work, myself having spent over 80 hours (including my precious holiday time) trying to dig, scratch, research up old posts that say it works or someone has it working under such and such a configuration! The documentation itself has folks claiming that it works and does not, which is really a bad practice. Why did you perpetuate this option in the first place?! I hope you see the importance and reason with my request and act immediately. ... Unless someone really really does have it working. Thank you

3 7

How can I configure Intermediate Certificate
by Carlos García Villate 04 Jan '11

04 Jan '11

Hi. Two months ago, we installed our SSL certificate with stunnel succesfully. That certificate was issued by Verisign. We did not experience any issues. A few weeks ago, we had to renew that certficate and after doing that, we started to get 'Invalid certificate' errors form our web site users. It seems that the new certificate issued by Verisign, has changed its hierarchy, and browsers like FF that do not have one of the necessary intermediate certificate registered fail. This is the new hierarchy: - VeriSign Class 3 Public Primary Certification Authority - G5 - VeriSign Class 3 Secure Server CA - G3 - www.b-kin.com It is the 'VeriSign Class 3 Secure Server CA - G3' certificate the one that most FF browsers do not have registered, and so the browsers reject the request with an 'Invalid certificate' message. To solve this issue, we are trying to incorporate the 'VeriSign Class 3 Secure Server CA - G3' certificate in the .pem file, where our www.b-kin.comcertificate is installed. We have tried to include the Verisign certificate first and then the other one; and the other way round, first our certificate and then the Verisign one, but without success. The Verisign certificate has been directly taken from the Verisign web site. The .pem file has following structure: Bag Attributes heading section ..... -----BEGIN RSA PRIVATE KEY----- ..... -----END RSA PRIVATE KEY----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- We are running stunnel on CentOS with the following configuration: stunnel 4.32 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = FIPS session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none As we have seen in the documentation, it is possible to include a certificate hierarchy in a .pem file. What we do not know is the order nor the values to set int Bag Attributes heading section, for the Verisign certificate. Best regards, Carlos.

1 0

Is it possible to encrypt the Web server IP , URL , Data???
by cpu.lin 20 Dec '10

20 Dec '10

Dear Michal Trojnara, Some protocols (e.g. ssh,vpn...) must install software in SERVER side. I want to understand the fact below: If only the CLIENT side can install the special software. What is the special software? Is it possible to encrypt the Web server IP ,URL ,Data??? If stunnel can solve this issue. How to configure? Merry X'mas, Best regards, cpu.lin(a)gmail.com > 2010/12/17 Michal Trojnara <Michal.Trojnara(a)mirt.net>: > Dear cpu.lin, > >> No response to the problem: >> > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html >> Could you please help me? > > This is how the protocol works: > http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt > You need a different protocol (e.g. ssh) if you don't like it. > > Mike

1 0

Stunnel 4.05 "SSL write shutdown (output buffer empty)"
by Issam ourrai 17 Dec '10

17 Dec '10

Hi guys, For My apps I'm using a SSL connection using STunnel 4.05 on a windows box. I have the following errors while running a connection : 2010.12.17 14:28:55 LOG7[2764:6312]: Socket closed on read 2010.12.17 14:28:55 LOG7[2764:6312]: SSL write shutdown (output buffer empty) 2010.12.17 14:28:55 LOG7[2764:6312]: SSL alert (write): warning: close notify 2010.12.17 14:28:55 LOG7[2764:6312]: SSL_shutdown retrying 2010.12.17 14:28:55 LOG7[2764:5588]: tradingscreen_connection accepted FD=1728 from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:5588]: FD 1728 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:5588]: Creating a new thread 2010.12.17 14:28:55 LOG7[2764:5588]: New thread created 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection started 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on local socket 2010.12.17 14:28:55 LOG5[2764:3860]: tradingscreen_connection connected from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:3860]: FD 1708 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection connecting XX.XX.XX.XX:9500 2010.12.17 14:28:55 LOG7[2764:3860]: remote connect #1: EWOULDBLOCK: retrying 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=write 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: Remote FD=1708 initialized 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on remote socket 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): before/connect initialization 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 write client hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 read server hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:56 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 read finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write change cipher spec A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 flush data 2010.12.17 14:28:56 LOG7[2764:3860]: 1 items in the session cache 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects (SSL_connect()) 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 client renegotiatations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects (SSL_accept()) 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server renegotiatiations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 1 session cache hits 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache misses 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache timeouts 2010.12.17 14:28:56 LOG6[2764:3860]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2010.12.17 14:28:56 LOG7[2764:6312]: SSL alert (read): warning: close notify 2010.12.17 14:28:56 LOG7[2764:6312]: SSL closed on SSL_read 2010.12.17 14:28:56 LOG7[2764:6312]: Socket write shutdown (*output buffer empty*) 2010.12.17 14:28:56 LOG5[2764:6312]: Connection closed: 31795 bytes sent to SSL, 35089 bytes sent to socket 2010.12.17 14:28:56 LOG7[2764:6312]: tradingscreen_connection finished (1 left) 2010.12.17 14:39:01 LOG7[2764:3860]: Socket closed on read 2010.12.17 14:39:01 LOG7[2764:3860]: SSL write shutdown (*output buffer empty*) 2010.12.17 14:39:01 LOG7[2764:3860]: SSL alert (write): warning: close notify 2010.12.17 14:39:01 LOG7[2764:3860]: SSL_shutdown retrying 2010.12.17 14:39:01 LOG7[2764:5588]: tradingscreen_connection accepted FD=1732 from 127.0.0.1:2362 2010.12.17 14:39:01 LOG7[2764:5588]: FD 1732 in non-blocking mode 2010.12.17 14:39:01 LOG7[2764:5588]: Creating a new thread Did some one ever face this kind of issue, I'm a neube using this connector, thanks for your kind help, -- Cheers Sam

1 0

Re: [stunnel-users] Experimental stunnel-4.35b1
by Michal Trojnara 17 Dec '10

17 Dec '10

Dear cpu.lin, > No response to the problem: > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html > Could you please help me? This is how the protocol works: http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt You need a different protocol (e.g. ssh) if you don't like it. Mike

1 0

Experimental stunnel-4.35b1
by Michal Trojnara 15 Dec '10

15 Dec '10

Dear Users, I have uploaded stunnel-4.35b1 to ftp://stunnel.mirt.net/stunnel/ for your testing. Please give it a shot and submit any problems to stunnel-users mailing list. This is the way you can not only help me improve production 4.35, but also make sure it's going to work on your platform! Please consider version 4.35b1 highly experimental and not ready for production. Specifically it is no supposed to be packaged for any OS distribution (e.g. *BSD ports). Best regards, Michal Trojnara

1 0

endpoints using different versions of stunnel
by nishith n 15 Dec '10

15 Dec '10

Hello all, We have a client who would like to send us data using stunnel 4.33 at their end of the connection. Can we establish connection from our end using stunnel 4.11 version. We are working on a sun machine. I know I can simply download the latest stunnel version but it has to go through an authorization process which probably will take more time than I have and hence this question. What could be the impacts to connectivity or otherwise with such a setup? Thanks for your replies, Nishith

1 0

Examples of stunnel and lighttpd
by fanboy 15 Dec '10

15 Dec '10

Apparently lighttpd ssl support isn't so flash, I'm been attempting (I'm a newb) to use stunnel instead, are there any examples? I have a free startssl cert also (ssl.key / ssl.cert) What information do I need to setup a reliable connection?

1 0

How to encrypt the URL?
by cpu.lin 08 Dec '10

08 Dec '10

Dear friends, After reading mailing lists & Web & FAQ I couldn't find answers to these: stunnel.conf as follows: debug=7 client = yes [proxy] accept=1111 connect=62.215.5.69:8080 (Public SSL Proxy) protocol=connect protocolHost=stunnel.mirt.net:443 CLIENT(Browser+Special software)<->firewall<->(Internet)<->Public SSL Proxy<->WEB SERVER Public SSL Proxy as follows: http://tools.rosinstrument.com/raw_free_db.htm?t=2 Only the CLIENT side have stunnel. After running stunnel 4.34 (Windows binaries). Then. Browser http://localhost:1111/ But Sniffer can monitor the command-(CONNECT stunnel.mirt.net:443). The problem as follows: Only the CLIENT side can install special software. Special software including but not limited to stunnel. If the firewall can block many websites depend on Web IP & URL. How to pass through the firewall base on Public SSL Proxy? How to encrypt the URL-(stunnel.mirt.net:443)? What is the special software? If stunnel can solve this issue. How to configure? Best regards, cpu

1 0

stunnel and IE6 issue
by Bill Tindal 06 Dec '10

06 Dec '10

Hi, I have stunnel running in front of HaProxy and everything is working fine however IE6 users cannot access our HTTPS pages and are instead shown a 'Page cannot be found'. They can access normal pages. Obviously there's something that stunnel doesn't like about IE6 (who doesn't) but I'm at a loss as to what changes to make to the stunnel conf. My conf for stunnel is below: ------------------------------------------------ sslVersion = all options = NO_SSLv2 fips = no setuid = root setgid = stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log [secure.domain.com] cert = /usr/local/openssl/certs/secure.domain.com.crt key = /usr/local/openssl/certs/secure.domain.com.key accept = X.X.X.X:443 connect = X.X.X.X:81 xforwardedfor = yes TIMEOUTclose = 0

1 0