- stunnel-users - stunnel.org

Re: [stunnel-users] STunnel performance Issues
by Michal Trojnara 11 Dec '06

11 Dec '06

"Jones Scott - sjones" <Scott.Jones(a)acxiom.com> wrote: > But during load testing the system starts breaking down. It takes about > 1/5 the load to break down apache and stunnel, than directly against my > jboss node. Could you elaborate on "break down", please? Is there an error? A core dump? What is the error message? A core dump stack backtrace? First performance recommendation is to disable libwrap support: ./configure --disable-libwrap && make clean && make && make install Best regards, Mike

1 0

STunnel performance Issues
by Jones Scott - sjones 11 Dec '06

11 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 *************************************************************************** The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank You. ****************************************************************************

1 0

SSL_accept: Peer suddenly disconnected
by James Brown 08 Dec '06

08 Dec '06

I'm trying to send an email through stunnel (which is running on the mail server), but I keep getting an error. $ sudo /usr/local/sbin/stunnel 2006.12.07 15:35:27 LOG7[6092:2684407744]: Snagged 64 random bytes from /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: Wrote 1024 new random bytes to /Users/jlbrown/.rnd 2006.12.07 15:35:27 LOG7[6092:2684407744]: RAND_status claims sufficient entropy for the PRNG 2006.12.07 15:35:27 LOG7[6092:2684407744]: PRNG seeded successfully 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate: /etc/postfix/ smtpd.cert 2006.12.07 15:35:27 LOG7[6092:2684407744]: Certificate loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: Key file: /etc/postfix/ smtpd.key 2006.12.07 15:35:27 LOG7[6092:2684407744]: Private key loaded 2006.12.07 15:35:27 LOG7[6092:2684407744]: SSL context initialized for service ssmtp 2006.12.07 15:35:27 LOG5[6092:2684407744]: stunnel 4.19 on i686-apple- darwin8.8.1 with OpenSSL 0.9.7l 28 Sep 2006 2006.12.07 15:35:27 LOG5[6092:2684407744]: Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv4 Auth:LIBWRAP 2006.12.07 15:35:27 LOG6[6092:2684407744]: file ulimit = 256 (can be changed with 'ulimit -n') 2006.12.07 15:35:27 LOG6[6092:2684407744]: FD_SETSIZE = 1024 (some systems allow to increase this value) 2006.12.07 15:35:27 LOG5[6092:2684407744]: 125 clients allowed 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 6 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 7 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: FD 8 in non-blocking mode 2006.12.07 15:35:27 LOG7[6092:2684407744]: SO_REUSEADDR option set on accept socket 2006.12.07 15:35:27 LOG7[6092:2684407744]: ssmtp bound to 0.0.0.0:465 2006.12.07 15:35:27 LOG7[6093:2684407744]: Created pid file /usr/ local/var/run/stunnel/stunnel.pid 2006.12.07 15:35:52 LOG7[6093:2684407744]: ssmtp accepted FD=9 from 192.168.1.4:62929 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp started 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 9 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: TCP_NODELAY option set on local socket 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 10 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: FD 11 in non-blocking mode 2006.12.07 15:35:52 LOG7[6093:25188864]: Connection from 192.168.1.4:62929 permitted by libwrap 2006.12.07 15:35:52 LOG7[6093:2684407744]: Cleaning up the signal pipe 2006.12.07 15:35:52 LOG5[6093:25188864]: ssmtp accepted connection from 192.168.1.4:62929 2006.12.07 15:35:52 LOG6[6093:2684407744]: Child process 6094 finished with code 0 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): before/ accept initialization 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 read client hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server hello A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write certificate A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 write server done A 2006.12.07 15:35:52 LOG7[6093:25188864]: SSL state (accept): SSLv3 flush data 2006.12.07 15:35:52 LOG3[6093:25188864]: SSL_accept: Peer suddenly disconnected 2006.12.07 15:35:52 LOG5[6093:25188864]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2006.12.07 15:35:52 LOG7[6093:25188864]: ssmtp finished (0 left) My stunnel.conf is: cert = /etc/postfix/smtpd.cert key = /etc/postfix/smtpd.key sslVersion = all socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log [ssmtp] client = no accept = 465 connect = 25 Does this mean that the SMTP proxy listening on port 25 is not accepting the connection from stunnel? Thanks, James.

2 4

Installing stunnel without need a compiler
by Boxall, John 05 Dec '06

05 Dec '06

Mike et al, I want to be able to automate the installation of stunnel in the same manner that I've already automated our openssh installation, however, I've run into a problem (lack of knowledge) with the "make install" step. This is for Solaris (2.5.1 to 10) and AIX (5.1 to 5.3). I'm not quite ready to create the packages in either Solaris (pkg) or AIX (rpm) formats. At a high level, here is what I would like to achieve: - On a build server (per OS version) - transfer all of the necessary stuff (gcc, openssl, stunnel source, etc.) - install the necessary stuff (gcc, openssl, etc.) - un'tar the stunnel package - run configure (with the appropriate options and paths) - run "make" - tar the stunnel directory & transfer it to a holding system - Put together the necessary pieces on the holding system to install stunnel on all targets. - On a target system (per OS version) - transfer all of the necessary stuff (libgcc, openssl, tar'ed stunnel directory, etc.) - install the necessary stuff (libgcc, openssl, zlib, etc.) - un-tar the stunnel file - run "make install" Using the same flow with our openssh packages, I do not have to install a compiler (gcc) and its support packages. What, if anything, can I do with the stunnel installation to not have to install a compiler? Regards, John Boxall

2 1

Re: [stunnel-users] Win: sometines don't connect
by Miroslav Geisselreiter 04 Dec '06

04 Dec '06

Hi My comments inline .... >>>>>> Miroslav Geisselreiter <mg(a)intar.cz> 12/01/06 8:04 PM >>> <SNIP> someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 I doubt how the "connect" option can be configured like this? should n't it be "connect = <yourfirstPC>:5900" and the accpet option should be "somotherpc:5600" <SNIP> Hope this helps! Regards Prem I think it is correct. On the first PC stunnel listens on localhost:5900 and passes securelly to second PC to port 5600. VNC on first PC connect to localhost port 5900. On the second PC stunnel accepts connection from any PC on port 5600 and passes to localhost (still second PC) to port 5900. VNC on second PC listens on port 5900. Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.6/566 - datum vydani: 3.12.2006 16:36

1 0

performance configuration for rehl3 & JBoss
by Jones Scott - sjones 01 Dec '06

01 Dec '06

I am having problems will apache and stunnel being able to handle load. I am using stunnel to encrypt my ajp traffic from apache to jboss. This helps me bridge our internal firewall. But during load testing the system starts breaking down. It takes about 1/5 the load to break down apache and stunnel, than directly against my jboss node. Any performance tuning recommendations would be great. I am using stunnel straight out of the box. I will place the configuration file below. Thanks. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /usr/local/stunnel/etc/stunnel/mail.pem ;key = /usr/local/stunnel/etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/stunnel/var/lib/stunnel/ setuid = nobody setgid = nogroup ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = certificates ; It's often easier to use CAfile CAfile = /usr/local/stunnel/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [ajp] accept = 8009 connect = xxxx2:8009 [sql] accept = 1433 connect = XXXX1:443 ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. *************************************************************************

1 0

Win: sometines don't connect
by Miroslav Geisselreiter 01 Dec '06

01 Dec '06

Hi, I use stunnel 4.16 on Windows 2000 and XP with this simple config: cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes verify = 3 [VNC2] accept = localhost:5900 connect = someotherpc:5600 When I start stunnel (as Win service), sometimes it forwards to someotherpc:5600 (it is correct) but sometimes it doesn't. Here is the debug 7 info: 2006.12.01 14:52:32 LOG7[3676:4060]: RAND_status claims sufficient entropy for the PRNG 2006.12.01 14:52:32 LOG7[3676:4060]: PRNG seeded successfully 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Certificate loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Key file: stunnel.pem 2006.12.01 14:52:32 LOG7[3676:4060]: Private key loaded 2006.12.01 14:52:32 LOG7[3676:4060]: Loaded verify certificates from cacerts.pem 2006.12.01 14:52:32 LOG7[3676:4060]: SSL context initialized for service VNC2 2006.12.01 14:52:32 LOG5[3676:4060]: stunnel 4.16 on x86-pc-mingw32-gnu with OpenSSL 0.9.7i 14 Oct 2005 2006.12.01 14:52:32 LOG5[3676:4060]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2006.12.01 14:52:32 LOG5[3676:3108]: No limit detected for the number of clients 2006.12.01 14:52:32 LOG7[3676:3108]: FD 180 in non-blocking mode 2006.12.01 14:52:32 LOG7[3676:3108]: SO_REUSEADDR option set on accept socket 2006.12.01 14:52:32 LOG7[3676:3108]: VNC2 bound to 127.0.0.1:5900 When it doesn't work correcly, it stops here, otherwise continues: 2006.12.01 14:52:34 LOG7[3676:3108]: VNC2 accepted FD=188 from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:3108]: Creating a new thread 2006.12.01 14:52:34 LOG7[3676:3108]: New thread created 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 started 2006.12.01 14:52:34 LOG7[3676:4008]: FD 188 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on local socket 2006.12.01 14:52:34 LOG5[3676:4008]: VNC2 connected from 127.0.0.1:1364 2006.12.01 14:52:34 LOG7[3676:4008]: FD 212 in non-blocking mode 2006.12.01 14:52:34 LOG7[3676:4008]: VNC2 connecting 192.168.1.172:5600 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: waiting 10 seconds 2006.12.01 14:52:34 LOG7[3676:4008]: connect_wait: connected 2006.12.01 14:52:34 LOG7[3676:4008]: Remote FD=212 initialized 2006.12.01 14:52:34 LOG7[3676:4008]: TCP_NODELAY option set on remote socket 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): before/connect initialization 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client hello A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server hello A 2006.12.01 14:52:34 LOG6[3676:4008]: *** starting OCSP verification *** 2006.12.01 14:52:34 LOG5[3676:4008]: VERIFY OK: depth=0, some info .... 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server certificate request A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read server done A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client certificate A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write client key exchange A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write certificate verify A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write change cipher spec A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 write finished A 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 flush data 2006.12.01 14:52:34 LOG7[3676:4008]: SSL state (connect): SSLv3 read finished A 2006.12.01 14:52:34 LOG7[3676:4008]: 1 items in the session cache 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects (SSL_connect()) 2006.12.01 14:52:34 LOG7[3676:4008]: 1 client connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 client renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects (SSL_accept()) 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server connects that finished 2006.12.01 14:52:34 LOG7[3676:4008]: 0 server renegotiations requested 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache hits 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache misses 2006.12.01 14:52:34 LOG7[3676:4008]: 0 session cache timeouts 2006.12.01 14:52:34 LOG6[3676:4008]: SSL connected: new session negotiated 2006.12.01 14:52:34 LOG6[3676:4008]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 someotherpc config is here: service = stunnel cert = stunnel.pem CAfile = cacerts.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 taskbar = yes [VNC] accept = 5600 connect = localhost:5900 It runs as win service too. Please help. -- Miroslav Geisselreiter -- Odchozi zprava neobsahuje viry. Zkontrolovano AVG. Verze: 7.5.432 / Virova baze: 268.15.3/562 - datum vydani: 1.12.2006 13:12

2 1

HTTPS proxy authentication
by Brett.Carroll＠bpd.treas.gov 01 Dec '06

01 Dec '06

I am trying to get stunnel to work through a HTTPS proxy but the current version doesn't seem to include the patch for this. Does the latest version (4.20) include https proxying support?

1 0

Problem in Stunnel with too many connections
by ~ Kunal Sharma ~ 01 Dec '06

01 Dec '06

Hi Friends, I've just joined this group. I would take this as an oppurtunity to discuss a problem I've been facing in using Stunnel. I've been using Stunnel for quite some time now. It has worked very well all this while. Recently, I had to shift our webserver onto the Internet and Stunnel accepts the https connections on the server's behalf. The problem is there are about 4.5 million clients out there in the field and there's a client coming up to the server atleast every second, if not less. Stunnel accepts the connections and after a while (like an hour) it just dies ! I see that at a point there are about 950 active connections and thats the maximum I could see before it dies. Could someone help me diagnose the problem (or better to fix it) - Is there any performance related issue thats a known problem and I don't know of ? - What I can look at to see what could be the possible cause ? - I haven't had a chance to look at the logs yet. Probably they might tell me something. - Any other pointers / inputs / suggestions would be heartily welcome. I've not been to my office so I won't be able to attach the necessary information like the version of stunnel, the logs, configuration options etc. But promise to send them as soon as I'm back on Monday after Thanksgiving. Thanks and Regards, Kunal

4 8

stunnel 4.20 released
by Michal Trojnara 30 Nov '06

30 Nov '06

Dear Users, I have just released a new version of stunnel. Here is the ChangeLog entry: Version 4.20, 2006.11.30, urgency: MEDIUM: * Release notes - The new transfer() function has been well tested. I recommend upgrading any previous version with this one. * Bugfixes - Fixed support for encrypted passphases (broken in 4.19). - Reduced amount of debug logs. - A minor man page update. Home page/download: http://stunnel.mirt.net/ sha1sum for stunnel-4.20.tar.gz fie: a9a449b28a4f34ab22f6b4bfaa81c1904a5883c4 Best regards, Mike

1 0