- stunnel-users - stunnel.org

Stunnel 4.26 - AIX 5.3
by Spence, Thomas Civ 844 CS/SCBX 26 Jan '09

26 Jan '09

Dear Users, * I'm running Stunnel 4.26 as a service, but it dies on logoff... * Could you tell me which one should I put comment "/* ... */" at stunnel.c or protocol.c so I want stunnel's daemon won't stop running. * I am using stunnel.conf, like this: ------- pid = cert = /usr/local/ssl/private/stunnel.pem output = stunnel.log [tssl] accept = 992 exec = /usr/sbin/telnetd ------- *stunnel.log ------- [/usr/local/etc/stunnel]# cat *.log 2009.01.21 16:42:54 LOG7[462906:1]: Snagged 64 random bytes from //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: Wrote 1024 new random bytes to //.rnd 2009.01.21 16:42:54 LOG7[462906:1]: RAND_status claims sufficient entropy for the PRNG 2009.01.21 16:42:54 LOG7[462906:1]: PRNG seeded successfully 2009.01.21 16:42:55 LOG7[462906:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Certificate loaded 2009.01.21 16:42:55 LOG7[462906:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2009.01.21 16:42:55 LOG7[462906:1]: Private key loaded 2009.01.21 16:42:55 LOG7[462906:1]: SSL context initialized for service tssl 2009.01.21 16:42:55 LOG5[462906:1]: stunnel 4.26 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8j 07 Jan 2009 2009.01.21 16:42:55 LOG5[462906:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2009.01.21 16:42:55 LOG6[462906:1]: file ulimit = 65534 (can be changed with 'ulimit -n') 2009.01.21 16:42:55 LOG6[462906:1]: poll() used - no FD_SETSIZE limit for file descriptors 2009.01.21 16:42:55 LOG5[462906:1]: 31999 clients allowed 2009.01.21 16:42:55 LOG7[462906:1]: FD 10 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 11 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: FD 12 in non-blocking mode 2009.01.21 16:42:55 LOG7[462906:1]: SO_REUSEADDR option set on accept socket 2009.01.21 16:42:55 LOG7[462906:1]: tssl bound to 0.0.0.0:992 2009.01.21 16:42:55 LOG7[540758:1]: No pid file being created 2009.01.21 16:43:17 LOG7[540758:1]: tssl accepted FD=0 from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: tssl started 2009.01.21 16:43:17 LOG7[540758:258]: FD 0 in non-blocking mode 2009.01.21 16:43:17 LOG7[540758:258]: Waiting for a libwrap process 2009.01.21 16:43:17 LOG7[540758:258]: Acquired libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Releasing libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: Released libwrap process #0 2009.01.21 16:43:17 LOG7[540758:258]: tssl permitted by libwrap from x.x.x.x:3532 2009.01.21 16:43:17 LOG5[540758:258]: tssl accepted connection from x.x.x.x:3532 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): before/accept initialization 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server hello A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write certificate A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write server done A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read client key exchange A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 read finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write change cipher spec A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 write finished A 2009.01.21 16:43:17 LOG7[540758:258]: SSL state (accept): SSLv3 flush data 2009.01.21 16:43:17 LOG7[540758:258]: 1 items in the session cache 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects (SSL_connect()) 2009.01.21 16:43:17 LOG7[540758:258]: 0 client connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 client renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects (SSL_accept()) 2009.01.21 16:43:17 LOG7[540758:258]: 1 server connects that finished 2009.01.21 16:43:17 LOG7[540758:258]: 0 server renegotiations requested 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache hits 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache misses 2009.01.21 16:43:17 LOG7[540758:258]: 0 session cache timeouts 2009.01.21 16:43:17 LOG6[540758:258]: SSL accepted: new session negotiated 2009.01.21 16:43:17 LOG6[540758:258]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2009.01.21 16:43:17 LOG7[540758:258]: bind#1: Invalid argument (22) 2009.01.21 16:43:17 LOG7[540758:258]: bind#2: Invalid argument (22) 2009.01.21 16:43:17 LOG6[540758:258]: Local mode child started (PID=639170) 2009.01.21 16:43:17 LOG7[540758:258]: Remote FD=13 initialized 2009.01.21 16:43:34 LOG7[540758:258]: Socket closed on read 2009.01.21 16:43:34 LOG7[540758:258]: SSL write shutdown 2009.01.21 16:43:34 LOG7[540758:258]: SSL alert (write): warning: close notify 2009.01.21 16:43:34 LOG6[540758:258]: SSL socket closed on SSL_shutdown 2009.01.21 16:43:34 LOG7[540758:258]: Socket write shutdown 2009.01.21 16:43:34 LOG5[540758:258]: Connection closed: 8360 bytes sent to SSL, 101 bytes sent to socket 2009.01.21 16:43:34 LOG7[540758:258]: tssl finished (0 left) ------- Your help will be appreciate... Thank you. ________________________________ Tom Spence AIX Sys Adm ABIDES System Support 844th CS/SCBX Pentagon - MD822

3 10

Use stunnel through firewall for home Web server?
by Bill Eldridge 25 Jan '09

25 Jan '09

I was interested in whether there's a simple way to have stunnel redirect traffic from a public Web browser/port to my home Web browser behind my DSL firewall (no ports opened/forwarded for incoming connections on the router, only outgoing-initiated) I scanned old posts but didn't find anything that quite fit - references are usually for people who want to get out from behind a firewall, not publish sites publicly from behind (i.e. externally initiated clicks)

4 12

Compilation problem
by fredzy padzy 21 Jan '09

21 Jan '09

Hi everyone I try to compile stunnel, but it fails. Actually, it tells me about a parse error inside signal.h, and i think it's a falsePositive. The configure works great and nothing look strange inside the configure.log. I also tried to googled those errors, but didn't find any clues. My server is a sunOS 10 and the src were taken from http://www.stunnel.org/download/stunnel/src/stunnel-4.26.tar.gz My version of openssl : OpenSSL 0.9.7.d Here are the errors, after the make command : /stunnel-4.26 root# make Making all in src make[1]: Entering directory `/root/syslogNG/stunnel-4.26/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.26\" -DPACKAGE_STRING=\"stunnel\ 4.26\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.26\" -DHOST=\"i386-pc-solaris2.10\" -DCPU_I386=1 -DVENDOR_PC=1 -DOS_SOLARIS2_10=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr/local/ssl\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/var/run/stunnel/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -MT file.o -MD -MP -MF ".deps/file.Tpo" -c -o file.o file.c; \ then mv -f ".deps/file.Tpo" ".deps/file.Po"; else rm -f ".deps/file.Tpo"; exit 1; fi *In file included from /usr/include/sys/signal.h:34,* from /usr/include/signal.h:26, from common.h:250, from file.c:38: /usr/include/sys/siginfo.h:259: error: parse error before "ctid_t" /usr/include/sys/siginfo.h:292: error: parse error before '}' token /usr/include/sys/siginfo.h:294: error: parse error before '}' token /usr/include/sys/siginfo.h:390: error: parse error before "ctid_t" /usr/include/sys/siginfo.h:392: error: conflicting types for `__proc' /usr/include/sys/siginfo.h:261: error: previous declaration of `__proc' /usr/include/sys/siginfo.h:398: error: conflicting types for `__fault' /usr/include/sys/siginfo.h:267: error: previous declaration of `__fault' /usr/include/sys/siginfo.h:404: error: conflicting types for `__file' /usr/include/sys/siginfo.h:273: error: previous declaration of `__file' /usr/include/sys/siginfo.h:420: error: conflicting types for `__prof' /usr/include/sys/siginfo.h:287: error: previous declaration of `__prof' /usr/include/sys/siginfo.h:424: error: conflicting types for `__rctl' /usr/include/sys/siginfo.h:291: error: previous declaration of `__rctl' /usr/include/sys/siginfo.h:426: error: parse error before '}' token /usr/include/sys/siginfo.h:428: error: parse error before '}' token /usr/include/sys/siginfo.h:432: error: parse error before "k_siginfo_t" /usr/include/sys/siginfo.h:437: error: parse error before '}' token In file included from /usr/include/signal.h:26, from common.h:250, from file.c:38: /usr/include/sys/signal.h:85: error: parse error before "siginfo_t" In file included from common.h:250, from file.c:38: /usr/include/signal.h:111: error: parse error before "siginfo_t" /usr/include/signal.h:113: error: parse error before "siginfo_t" In file included from common.h:251, from file.c:38: /usr/include/sys/wait.h:86: error: parse error before "siginfo_t" make[1]: *** [file.o] Error 1 make[1]: Leaving directory `/root/syslogNG/stunnel-4.26/src' make: *** [all-recursive] Error 1 Is that normal that i've 2 signal.h files ?

1 0

Re: [stunnel-users] ftp to sftp
by Michael Renner 18 Jan '09

18 Jan '09

On Friday 16 January 2009, aaa aaa wrote: > Hello, Moin, > I am using last edition of stunnel. I would like to use my favourite ftp > client and connect to sftp. But my ftp clinet don't allow this so I would > like to use stunnel if possible. How should I configure stunnel to do this > (ports etc.)? I am a newbie with stunnel but I am using it for sending > email for several weeks and everything works well. So I hope it is possible > to use it for sftp too. there are 2 'save' ftp enhancement: sftp and ftps. While 'sftp' means 'ftp over ssh' stand 'ftps' for 'ftp over ssl'. So stunnel is the wrong tool if you have to use ftps. Please check http://www.stunnel.org/examples/ftp.html for more information about stunnel and ftp. CU -- |Michael Renner E-mail: michael.renner(a)gmx.de | |D-81541 Munich Germany ICQ: #112280325 | |Germany Don't drink as root! ESC:wq

2 2

Re: [stunnel-users] ftp to sftp
by Justin Greene 16 Jan '09

16 Jan '09

I do not think that this can work. SFTP is not just encrypted FTP traffic, but an entirely different protocol. Justin ________________________________ From: aaa aaa [mailto:miamia@inMail.sk] Sent: Friday, January 16, 2009 7:58 AM To: stunnel-users(a)mirt.net Subject: ftp to sftp Hello, I am using last edition of stunnel. I would like to use my favourite ftp client and connect to sftp. But my ftp clinet don't allow this so I would like to use stunnel if possible. How should I configure stunnel to do this (ports etc.)? I am a newbie with stunnel but I am using it for sending email for several weeks and everything works well. So I hope it is possible to use it for sftp too. Any help much appreciated. thanks in advance. ----------

1 0

0x09 bytes in stunnel-4.26/src/Makefile.am
by Andrew Schulman 14 Jan '09

14 Jan '09

For some strange reason, there are five hex 09 bytes in stunnel-4.26/src/Makefile.am. This broke my Cygwin build: I remove the Windows-only stuff from this file for Cygwin, and diff captured the 0x09 characters that got removed, but then when I later tried to apply the patch, patch choked on them. It seems that each of these bytes should really be 0x0A. Strange. Andrew.

2 2

Re: [stunnel-users] How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

On Jan 13, 2009, at 11:07 AM, Karl J. Runge wrote: > On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote: >> >> I'm sure I could get something like that to work on Unix. >> Unfortunately, I need a cross-platform solution:; unix & windows. >> And >> (as usual) the windows side is harder to work around. >> >> What I really need to do is send a known amount of binary data in a >> file over an SSL connection to a remote machine, then get back the >> reply of unknown length into a separate file: >> >> stunnel test.conf <test.in >test.out >> >> I'm open to any suggestions on how to do this, (such that it will >> work >> on unix and windows). > > So it is not an https URL like in your example? If it were, perhaps > wget or curl for windows would be a better path than stunnel. I'm using a simple web-page fetch for debugging. In actual use, the situation is more complicated and wget and curl won't work. Thx for the suggestion, though. > > > socat might be ported to windows, I'm not sure. If writing a small C > wrapper program for Windows is not acceptable, I'm not sure what you > can do. socat appears to be linux-mostly. (They have a MacOS-X port, which suggests that it is not even "unix" neutral.) So I'm guessing that windows is out of the question there. Looks like I'm just going to have to bite the bullet and link against OpenSSL directly..... > > > > BTW, I have made a one-time connection patch to stunnel that I use > with > my VNC tool SSVNC: > > http://libvncserver.cvs.sourceforge.net/viewvc/libvncserver/libvncserver/x1… > > It is a hack, but useful. My VNC tool works OK with stock stunnel > (everything else equal I prefer using), but I also distribute a > patched > stunnel for more reliable behavior in this one-time client connect > mode. > > Karl > D. Richard Hipp drh(a)hwaci.com

2 1

Re: [stunnel-users] How do I do a one-time client connection?
by stunnel-hm＠karlrunge.com 13 Jan '09

13 Jan '09

On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote: > > Apparently stunnel will work as a pipe if I create a config file like > this: > > client=yes > connect=remosthost:port > > Then run stunnel and talk over standard input and standard output. One problem I have found in doing this is that if socketpair(2) is used to create the file descriptor that will be connected to stunnel's stdio, then stunnel's libwrap checking is activated because it detects it to be a socket. Using socketpair is a nice way to turn a TCP client into one that connects via a two-way pipe with stunnel (because the client app doesn't have to special case the two file descriptors for stunnel's stdin and stdout when reading and writing.) Since a user (i.e. not a sysadmin) has no control over the libwrap settings in /etc, stunnel's libwrap check will always fail when used this way. In my opinion, stunnel should allow disabling of libwrap (and syslog too) via the config file (i.e. not just compile time options). This makes the "one connection" client usage you describe work better. Karl

1 0

Re: [stunnel-users] How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

Perhaps I spoke too soon about having solved my own problem. Suppose I have a configuration file (test.conf) like this: client=yes connect=www.fossil-scm.org:443 Then if I run: stunnel test.conf And I type "GET / HTTP/1.0" on standard input, the webpage comes back on standard output. So far so good. But if I do: stunnel test.conf <test.in >test.out Where file test.in contains the "GET / HTTP/1.0" test, I get nothing back! I also tried this: cat test.in | stunnel test.conf And various combinations of this: openssl s_client -connect www.fossil-scm.org:443 <test.in In every case, when I type the GET line on standard input it works. When I redirect from a file it does not. Any hints on the cause of the very unexpected and very mysterious behavior? D. Richard Hipp drh(a)hwaci.com

1 0

How do I do a one-time client connection?
by D. Richard Hipp 13 Jan '09

13 Jan '09

I'd like to invoke stunnel to handle a single SSL client-side connection (talking to an SSL server) with the assurance that the stunnel quit will automatically quit after that one connection closes. I did not see any options to support this. Did I overlook something, or is stunnel just not able to do this? D. Richard Hipp drh(a)hwaci.com

1 1