- stunnel-users - stunnel.org

Application level encryption or driver level encryption
by atsushi kataoka 12 Aug '07

12 Aug '07

Hi, I have to secure one of my proprietary remote connection server running on windows XP . One option is to secure using the stunnel.Other options are writing some drivers for windows. Presently we are evaluating which option is better whether to opt for application level - stunnel or go for driver - some network filter driver. Can somebody tell me what will be advantages of following application level approach. One more point what is the impact on the performance of using stunnel. Regards.

1 0

Stunnel writing strange timestamps into my logs
by Van 10 Aug '07

10 Aug '07

I was looking through /var/log/messages for another reason and I notice this (representitive log snippet below) It's 10:50 am and while automount is writing messages that jibe with the correct time (see line 5 for example. This part of my log is from about 90 min ago), stunnel seems to be 4 hours ahead, labelling things as happening at about 1pm while everything else is happening about 9am. Where is stunnel getting it's time from? And why a separate source? How can I correct this? - Van Aug 10 13:13:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54923 Aug 10 13:13:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1409 Aug 10 13:13:34 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54927 Aug 10 09:14:13 <myserver> automount[30173]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:14:13 <myserver> automount[30173]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:14:13 <myserver> automount[30173]: failed to mount /nfs/bmgm Aug 10 13:14:18 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from XX.XX.61.195:1057 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54947 Aug 10 13:16:02 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 150 bytes sent to SSL, 41 bytes sent to socket Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60220 Aug 10 13:18:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s connected remote server from 127.0.0.1:54948 Aug 10 13:18:03 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 211 bytes sent to SSL, 56 bytes sent to socket Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps accepted connection from XX.XX.61.109:1410 Aug 10 13:18:39 <myserver> stunnel: LOG5[29760:3086109600]: imaps connected remote server from 127.0.0.1:54952 Aug 10 13:19:23 <myserver> stunnel: LOG5[29760:3086109600]: Connection closed: 1013 bytes sent to SSL, 271 bytes sent to socket Aug 10 09:20:31 <myserver> automount[30282]: >> mount: mount to NFS server 'mgm' failed: System Error: Connection timed out. Aug 10 09:20:31 <myserver> automount[30282]: mount(nfs): nfs: mount failure mgm:/bmgm on /nfs/bmgm Aug 10 09:20:31 <myserver> automount[30282]: failed to mount /nfs/bmgm Aug 10 13:23:01 <myserver> stunnel: LOG5[29760:3086109600]: pop3s accepted connection from 71.167.170.42:60225

1 0

Tunneling though an Http proxy
by Honka 10 Aug '07

10 Aug '07

Hi there, i'm trying to set up stunnel on my laptop which I use at work, and i'm trying to tunnel to my home pc for remote desktop. The only open ports on the work network are 8080, 80 and 443. So I have setup the tunnel to port 8080 onto my home pc and had it working across the network at home. (via internal and external ip's) however it isn't working here. I am assuming because we have an http proxy which requires authentication. So i'm wondering, how can I make stunnel use and authenticate with this proxy so that it will work? Cheers Honka

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? i'm trying to install in a full root solaris 10 zone thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Make Install Error
by Morris Hooten - SLS Business Infrastructure 05 Aug '07

05 Aug '07

why do i get this when running make install at the very end? thanks SunOS mknod: Not owner chmod: WARNING: can't access /usr/local/var/lib/stunnel/dev/zero make[2]: *** [install-data-local] Error 1 make[2]: Leaving directory `/stunnel/stunnel-4.20/tools' make[1]: *** [install-am] Error 2 make[1]: Leaving directory `/stunnel/stunnel-4.20/tools' make: *** [install-recursive] Error 1

1 0

Stunnel message about SSL_shutdown/SSL_get_error
by Lachance, Mario 03 Aug '07

03 Aug '07

Hi, I have been using openssl_0.9.7g and stunnel_4.10 on Solaris 9 without problem for 2 years in a production environment. I want to upgrade to openssl_0.9.8e and stunnel_4.20 on solaris 10. I have done some test on a development system and I have seen a new message in stunnel log file. Old message with openssl_0.9.7g and stunnel_4.10 on Solaris 9 was : Aug 3 14:51:58 solario stunnel[345]: [ID 702911 local6.notice] Too many retries on SSL shutdown New message with openssl_0.9.8e and stunnel_4.20 on solaris 10 is : Aug 3 14:42:30 daprxuu stunnel: [ID 821868 local6.error] LOG3[20957:4]: SSL_shutdown/SSL_get_error returned 6 I don't know if this new message has replaced the old one I was getting. Can someone tell me what is behind this message "_shutdown/SSL_get_error returned 6"? Please note that I am able to transfer message with both system (stunnel 4.10 and stunnel 4.20) from a windows client without any apparent problem. Thank you for your help, Mario Avis de confidentialité: Ce message est confidentiel, protégé par le secret professionnel et à l'usage exclusif du destinataire. Toute autre personne est avisée qu'il lui est strictement interdit de le diffuser, distribuer ou reproduire. Si vous avez reçu ce message par erreur, avisez-nous immédiatement par téléphone et effacez toute copie. Confidentiality Notice: This e-mail is confidential, privileged and intended for the exclusive use of the addressee. Any other person is strictly prohibited from disclosing, distributing or reproducing it. If you have received this e-mail by mistake, please notify us immediately by telephone and delete all copies.

1 0

Re: [stunnel-users] stunnel hanging during negotation with an smtp server
by Hans Werner Strube 01 Aug '07

01 Aug '07

Jason J. Corso wrote: > [ssmtp] > accept = 127.0.0.1:25 > connect = xxxxxx:465 > protocol = smtp > ------- > > However, when I try to send a mail, it appears to hang while > negotiating with the remote server. Here is the output: ... > 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server > side) started > 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected Your stunnel seems to be running in server mode. For client mode, add client = yes Also, if you need pure SSL rather than TLS negotiation, remove protocol = smtp

2 1

stunnel hanging during negotation with an smtp server
by Jason J. Corso 31 Jul '07

31 Jul '07

Please help: I'm trying to use stunnel to connect to a secure SMTP server -- I'm using MS Entourage 2004 on an Intel 10.4 Mac. Entourage cannot connect directly to the SMTP server over SSL because it no longer supports NTLM version 1 authentication, which the SMTP server uses. I believe stunnel can be used to workaround this problem (if I'm wrong, please say so), i.e., Entourage can connect locally to stunnel which will then connect to the remote server over SSL properly. I built and installed stunnel version 4.04-12 via Fink (compiled from source via Fink) and OpenSSL 0.9.7i-4 also via Fink. I have the following configuration file: ------ # Comment it out on Win32 cert = /sw/etc/stunnel/stunnel.pem chroot = /sw/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = nobody setgid = nogroup # Some debugging stuff debug = 7 output = /dev/stdout foreground = yes [ssmtp] accept = 127.0.0.1:25 connect = xxxxxx:465 protocol = smtp ------- However, when I try to send a mail, it appears to hang while negotiating with the remote server. Here is the output: 2007.07.31 15:41:19 LOG5[5511:2684407808]: stunnel 4.04 on i386-apple-darwin8.10.1 PTHREAD+LIBWRAP with OpenSSL 0.9.7i 14 Oct 2005 2007.07.31 15:41:19 LOG7[5511:2684407808]: Snagged 64 random bytes from xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: Wrote 1024 new random bytes to xxx/.rnd 2007.07.31 15:41:19 LOG7[5511:2684407808]: RAND_status claims sufficient entropy for the PRNG 2007.07.31 15:41:19 LOG6[5511:2684407808]: PRNG seeded successfully 2007.07.31 15:41:19 LOG7[5511:2684407808]: Certificate: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG7[5511:2684407808]: Key file: /sw/etc/stunnel/stunnel.pem 2007.07.31 15:41:19 LOG5[5511:2684407808]: FD_SETSIZE=1024, file ulimit=256 -> 125 clients allowed 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 6 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: SO_REUSEADDR option set on accept socket 2007.07.31 15:41:19 LOG7[5511:2684407808]: ssmtp bound to 127.0.0.1:25 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 7 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: FD 8 in non-blocking mode 2007.07.31 15:41:19 LOG7[5511:2684407808]: Created pid file /stunnel.pid 2007.07.31 15:41:25 LOG7[5511:2684407808]: ssmtp accepted FD=9 from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:2684407808]: FD 9 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp started 2007.07.31 15:41:25 LOG5[5511:25183744]: ssmtp connected from 127.0.0.1:50091 2007.07.31 15:41:25 LOG7[5511:25183744]: FD 10 in non-blocking mode 2007.07.31 15:41:25 LOG7[5511:25183744]: ssmtp connecting xxx.xxx.xxx.xxx:465 2007.07.31 15:41:25 LOG7[5511:25183744]: remote connect #1: EINPROGRESS: retrying 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=write 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: ok 2007.07.31 15:41:25 LOG7[5511:25183744]: Remote FD=10 initialized 2007.07.31 15:41:25 LOG7[5511:25183744]: Negotiations for smtp(server side) started 2007.07.31 15:41:25 LOG7[5511:25183744]: RFC 2487 detected 2007.07.31 15:41:25 LOG7[5511:25183744]: waitforsocket: FD=10, DIR=read ********* HANGS HERE *********** ...and I have to kill it. I am very new to stunnel and openssl. So, I may be making a simple mistake. But, I could not find the solution on the mailing list or the web. What am I doing wrong? To be clear, the server is using SSL for SMTP. I am able to send mail directly via the smtp server from other mail clients like Thunderbird. Thanks. Any help is much appreciated. Jason

1 0

Re: [stunnel-users] Stunnel Scalability Question
by Ankur Upadhyaya 30 Jul '07

30 Jul '07

Hi Michal, Thank you for your help with this. My stunnel -version output can be found below. Ankur stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 1