- stunnel-users - stunnel.org

Re: [stunnel-users] failed to build stunnel 4.25 under VS 2005
by Michal Trojnara 29 Aug '08

29 Aug '08

On Fri, 29 Aug 2008 00:00:56 +0800, "Ericdai" <pcix133(a)hotmail.com> wrote: > I try to build Stunnel 4.25 under VS2005 ,but failed Today I updated stunnel, so it can be built with Visual C++ 2008 (known also as Visual C++ 9.0). My plan is to release stunnel 4.26 next week. > prototypes.h(428) : error C2081: 'socklen_t' : name in formal > parameter list illegal I had no problem with socklen_t. Maybe it's specific to the old version of Visual C++. > I also suggest build a windows client only version > n It only can be running on windows > n It only can act as a client > n I think it can reduce the code size and runtime footprice smaller Not really. The difference would be negligible. Best regards, Mike

1 0

failed to build stunnel 4.25 under VS 2005
by Ericdai 28 Aug '08

28 Aug '08

I try to build Stunnel 4.25 under VS2005 ,but failed cl -MD -W3 -Ox -O2 -Ob2 -Gs0 -GF -Gy -GL -nologo -I"..\..\ssl\inc32" -DUSE_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE -DHAVE_GETADDRINFO -DHAVE_GETNAMEINFO -D_MBCS /c stunnel.c stunnel.c prototypes.h(428) : error C2081: 'socklen_t' : name in formal parameter list illegal stunnel.c(206) : error C2065: 'socklen_t' : undeclared identifier stunnel.c(206) : error C2146: syntax error : missing ';' before identifier 'addrlen' stunnel.c(206) : error C2065: 'addrlen' : undeclared identifier I use nmake -f vc.mak to do it Anyone has build it successfully ,pls help me ! Another way ,is there a stunnel solution or project file ? I also suggest build a windows client only version n It only can be running on windows n It only can act as a client n I think it can reduce the code size and runtime footprice smaller Thanks and best regards Eric dai

1 0

Re: [stunnel-users] In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Friday 22 August 2008 you wrote: > I noticed that when running stunnel from within the jail it logs its > messages with syslong using UTC. > > My question is how would one reconcile timezone of chrooted stunnel with a > system one? > > The issue illustrated: > > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on > i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD > SSL:ENGINE Sockets:POLL,IPv4 > Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients > allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 > connected from 127.0.0.1:1469 > Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: > depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet > > xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in > chrooted environment and thus uses UTC (if it's not chrooted it reports > localtime to syslog facility). > > Any ideas? Jee that was simple! cp /etc/localtime /var/lib/stunnel/etc/ (on each machine where stunnel runs) and you're done :^) -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

In chrooted environment system times defaults to UTC
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

I noticed that when running stunnel from within the jail it logs its messages with syslong using UTC. My question is how would one reconcile timezone of chrooted stunnel with a system one? The issue illustrated: Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: stunnel 4.17 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Aug 22 12:29:40 xerxes stunnel: LOG5[26569:3083679424]: 500 clients allowed Aug 22 12:29:40 xerxes stunnel: LOG5[26570:3086773168]: 5101 connected from 127.0.0.1:1469 Aug 22 09:29:40 xerxes stunnel: LOG5[26570:3086773168]: VERIFY OK: depth=0, /C=UA/ST=ARC/L=Simferopol/O=HOMELAB/CN=sega.localnet xerxes' localtime is GMT+3 and sega's too, but stunnel runs on sega in chrooted environment and thus uses UTC (if it's not chrooted it reports localtime to syslog facility). Any ideas? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Certificates, Servers & Clients. Clarify this please.
by Ivan Lezhnjov Jr. 22 Aug '08

22 Aug '08

Now that I've read a bunch of articles and have seen a pile of examples of how pairs of a certificate and a private key can be created I must say they all suggest different approaches and techniques to creating certificates and ultimately bewildered me. Could anyone please explain as simply as possible, in layman's terms what exactly must be done? Let's talk about simple scenario with two hosts (A & B) involved, both running stunnel. Let us assume host A is the server and host B is the client. cert = CAfile = must be created. And we use verify level 3 (verify = 3) So, what exactly do we do now? And what happens in the dialog between these two machines? -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Can't start stunnel (dies mysteriously)
by Ivan Lezhnjov Jr. 19 Aug '08

19 Aug '08

Hello there I run stunnel version 4.21 and openssl version 0.9.8h. In my setup I aim to create a tunnel to send log files through to a centralized loghost. Host A (loghost) runs Source Mage GNU/Linux (with stunnel 4.21, openssl 0.9.8h) and host B runs Slackware 11 system (with stunnel 4.17, openssl 0.9.8h). The problem is that stunnel starts on host B but won't start on host A. Here's the snippet of /var/log/messages that records stunnel start-up event: root@sega:/home/users/ilj % stunnel && tail /var/log/messages -n 3 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Aug 19 16:17:37 sega stunnel: LOG5[29146:3082634944]: 500 clients allowed I've actually been trying to run stunnel for the first time ever so I don't really know if this output confirms that everything is alright but judging solely from what is put in log file it seems stunnel has started successfully. Unfortunately, this isn't quite true root@sega:/home/users/ilj % ps ax | grep stun 29618 pts/4 R+ 0:00 grep stun So, this is the problem I have. It doesn't start on host A. Host A has the following stunnel configuration: root@sega:/home/users/ilj % cat /etc/stunnel/stunnel.conf cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem verify = 3 [5101] accept = 217.117.75.2:5101 connect = 127.0.0.1:1999 Host B sports a little bit different configuration file: root@xerxes:~ % cat /etc/stunnel/stunnel.conf client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 [5101] accept = 127.0.0.1:1999 connect = 217.117.75.2:5101 On both hosts (A & B) I run stunnel standalone as root. > 4. Output of "stunnel -f -D 7 <your-parameters>". Erm.. it doesn't seem to work for me. There's no -D parameter according to man stunnel. The following information below is about host A only: root@sega:/home/users/ilj % stunnel -version stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none root@sega:/home/users/ilj % uname -a Linux sega 2.6.24 #5 SMP PREEMPT Wed May 7 18:22:29 EEST 2008 i686 GNU/Linux root@sega:/home/users/ilj % gaze from /usr/lib/libc.a glibc-2.7:/usr/lib/libc.a root@sega:/home/users/ilj % gcc -v Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/4.2.3/specs Target: i686-pc-linux-gnu Configured with: /usr/src/gcc-4.2.3/configure --host=i686-pc-linux-gnu --prefix=/usr --infodir=/usr/share/info --mandir=/usr/share/man --enable-threads=posix --with-system-zlib Thread model: posix gcc version 4.2.3 root@sega:/home/users/ilj % gaze installed | grep openssl openssl:20080615:installed:0.9.8h -- Ivan Lezhnjov Jr. Europe, Ukraine, Simferopol Running Source Mage GNU/Linux, kernel version 2.6.24 build #5 +----------------------------------------------------------------------+ Key ID 0x5811D90C Key Fingerprint 2A52 5C8C 38BE C04F D8DE A169 19E2 E49A 5811 D90C Use GPG Exercise Your Right To Privacy

1 0

Disable libwrap at runtime?
by Jans, Kert 16 Aug '08

16 Aug '08

Hi, Is it possible to disable libwrap support at runtime? I've reviewed the archives and documentation and cannot determine if this is possible. I know it is possible to compile-out support for libwrap by using: configure --disable-libwrap Is compiling-out support the only way? I'd like to disable support in a pre-build version of stunnel. Regards, Kert

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 15 Aug '08

15 Aug '08

Ah ha - "verify = 3" - thanks! On 15/08/2008, at 9:12 AM, Brian Hatch wrote: >> > Mutual authentication uses the verify option on both > ends, rather than just on one end. Both sides verify, > and both sides present a certificate.

2 1

Re: [stunnel-users] Mutual SSL Authentication
by Christopher Hunt 14 Aug '08

14 Aug '08

On 14/08/2008, at 8:00 PM, Michal.Trojnara(a)mobi-com.net wrote: > Sure. Stunnel supports mutual SSL authentication. > Please read the fine manual for details. Hi Mike, Thanks for the reply. I did quite a lot of trawling on the web, your website and the stunnel man pages and couldn't find any guidance on mutual ssl authentication configuration. Are you able to give me a pointer, perhaps a URL to something that contains an example? Thanks again. Cheers, -C

1 0

Stunnel connection drops after four http requests
by Renner, Christopher R 13 Aug '08

13 Aug '08

With quite a bit of help from a list member here, I have stunnel 4.25 running on OSX 1.5.4 (PHP development environment). Problem is I can only get four http requests to the server before the connection is dropped. Stunnel is still running in the background.

1 0