- stunnel-users - stunnel.org

stunnel OK without "transparent = source", with = timeout problem
by Elodie BOSSIER 03 Aug '11

03 Aug '11

Greetings again, Thanks so much to have updated the manual about SNI, my stunel works correctly. But i have a tiny problem, when i visit my webserver, the SERVER['REMOTE_ADDR'] with PHP isn't the ip adress of the visitor but the IP of the stunnel. I have read the manual about this transparent proxy and i don't sucess with the configuration. This is my config file : pid = /stunnel.pid options = NO_SSLv2 transparent = source [virtual] accept = 443 cert = /usr/local/openssl/etc/CERTIFICATES/www.franceserv.fr_cert.cert key = /usr/local/openssl/etc/PRIVATE_KEYS/www.franceserv.fr_key.pem connect = www.franceserv.fr:80 [sni1] sni = virtual:elodie.franceserv.com cert = /etc/ssl-fsh/cert-elodie.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = elodie.franceserv.com:80 [sni2] sni = virtual:befun.franceserv.com cert = /etc/ssl-fsh/cert-befun.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = befun.franceserv.com:80 It's don't work, i have a timeout with my browser. With iptables, i have set this : iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter echo 1 > /proc/sys/net/ipv4/ip_forward My stunnel is on the server 192.168.0.20 and the webserver on 192.168.0.2 I try to follow the help of http://www.stunnel.org/static/stunnel.html#service_level_options with : transparent = none | source | destination | both (Unix only) Could you tell me what i make wrong please ?

2 4

Failed to run 2 instances of windows service (error 1053)
by Laurent Licour 03 Aug '11

03 Aug '11

I have to run at the same time on the same windows host, 2 instances of stunnel : a client instance and a server instance I have 2 config files : stunnel-client.conf , stunnel-server.conf Each configuration works, but not at the same time. I can install 2 services (with differents service name), but i can't start both services at the same time. I have to stop the first one to start the second one stunnel.exe -install stunnel-client.conf stunnel.exe -install stunnel-server.conf stunnel.exe -start stunnel-client.conf stunnel.exe -start stunnel-server.conf --> error 1053 stunnel.exe -stop stunnel-client.conf stunnel.exe -start stunnel-server.conf stunnel.exe -start stunnel-client.conf --> error 1053 It is also not possible to start the both configurations directly (no service mode). test run with stunnel 4.42b2 on windows XPe and Win2008R2 -- Laurent LICOUR

2 1

Failed to run 2 instances of windows service (error 1053)
by Laurent Licour 01 Aug '11

01 Aug '11

I have to run at the same time on the same windows host, 2 instances of stunnel : a client instance and a server instance I have 2 config files : stunnel-client.conf , stunnel-server.conf Each configuration works, but not at the same time. I can install 2 services (with differents service name), but i can't start both services at the same time. I have to stop the first one to start the second one stunnel.exe -install stunnel-client.conf stunnel.exe -install stunnel-server.conf stunnel.exe -start stunnel-client.conf stunnel.exe -start stunnel-server.conf --> error 1053 stunnel.exe -stop stunnel-client.conf stunnel.exe -start stunnel-server.conf stunnel.exe -start stunnel-client.conf --> error 1053 It is also not possible to start the both configurations directly (no service mode). test run with stunnel 4.42b2 on windows XPe and Win2008R2 -- Laurent LICOUR

1 0

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

DH parameters
by yyy 30 Jul '11

30 Jul '11

Hello! How to specify custom DH parameters? There is an option for specifying ECDH curve (curve option), but not for ordinary DH. Searching man page for "DH" did not yield anything. Searching this list archive for "DH paramaeters" found only some default error messages.

2 1

Re: [stunnel-users] Problem with SNI "Specified option name is not valid here"
by Michal Trojnara 26 Jul '11

26 Jul '11

I wrote: > AFAIR SNI is supported in OpenSSL 1.0.0 and later. I will confirm it > and I will update the manual page if needed. I updated the manual: http://www.stunnel.org/static/stunnel.html Mike

1 0

stunnel 4.41 released
by Michal Trojnara 25 Jul '11

25 Jul '11

Dear Users, I have released version 4.41 of stunnel. This is a bugfix release. I highly recommend Windows users to upgrade. The ChangeLog entry: Version 4.41, 2011.07.25, urgency: MEDIUM: * Bugfixes - Fixed Windows service crash of stunnel 4.40. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.41.tar.gz: 08e0e7df42bfb8b8551eb6c4b5b50eae6051aaf75077101d729e67c7a3a00c72 Best regards, Mike

1 0

Issue with -quiet option (Windows 2000 Server SP4)
by rtr purchase 25 Jul '11

25 Jul '11

Hello, Thank you for STunnel. I've been using BLAT command line mailer for years at a client's site to send system status messages to me. Recently the client switched to ATT's SSL protected email. Blat does not support SSL. STunnel to the rescue. I started with ver. 4.39. I wanted to start and stop the STUNNEL service via script commands but found that the -quiet switch did not suppress the OK message box consistently. This naturally stopped the script from continuing. This was true of both the -start and -stop functions but was more of an issue with the -stop function. While looking through the documentation to see what I might be doing wrong, I saw that 4.40 was released (the day after I downloaded 4.39). 4.40 has the same issue with the -quiet switch but the addition of the -exit switch allowed me to start and stop STUNNEL without running it as a service. Great timing! I had tested my scripts using a Windows 7 machine where they functioned as expected. It was only when I moved them to the client's Windows 2000 Server (SP4) that this issue appeared.

1 0

Problem with SNI "Specified option name is not valid here"
by Elodie BOSSIER 25 Jul '11

25 Jul '11

Greetings, I try to use SNI with stunnel with following this help : http://answerpot.com/showthread.php?2708344-Server-side+SNI+support but i have this erreor : Line 90: "sni = virtual:elodie.franceserv.com": Specified option name is not valid here My config : stunnel 4.40 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 0.9.8o 01 Jun 2010 A part of my config file : [virtual] accept = 443 cert = /etc/ssl-fsh/cert-www.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = www.franceserv.fr:80 [sni1] ; notice that "sni" option is used instead of "accept" sni = virtual:elodie.franceserv.com cert = /etc/ssl-fsh/cert-elodie.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = elodie.franceserv.com:80 [sni2] ; notice that "sni" option is used instead of "accept" sni = virtual:befun.franceserv.com cert = /etc/ssl-fsh/cert-befun.franceserv.com.pem key = /etc/ssl-fsh/key-franceserv.key connect = befun.franceserv.com:80 Thanks so much.

1 0

stunnel 4.40 released
by Michal Trojnara 23 Jul '11

23 Jul '11

Dear Users, I have released version 4.40 of stunnel. The ChangeLog entry: Version 4.40, 2011.07.23, urgency: LOW: * New Win32 features - Added a GUI menu to save cached peer certificate chains. - Added "-exit" option to stop stunnel *not* running as a service. This option may be useful for scripts. - Added file version information to stunnel.exe. - A number of other GUI improvements. * Other new features - Hardcoded 2048-bit DH parameters are used as a fallback if DH parameters are not provided in stunnel.pem. - Default "ciphers" value updated to prefer ECDH: "ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH". - Default ECDH curve updated to "prime256v1". - Removed support for temporary RSA keys (used in obsolete export ciphers). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.40.tar.gz: 91f32c7654dde0e1cf37ed0d8517e0d0b5985cd30443a9d64cd33d232b5fe9ce Best regards, Mike

1 0