October 2004 - stunnel-users

compressed stunnel?
by jonathan.wilson 07 Nov '04

07 Nov '04

Hi all, I found some references to compression options in openssl.org - specifically to the SSL_COMP_add_compression_method() routine. Is there any way to invoke/use this from stunnel? Thanks, Jonathan Wilson

2 1

Re: [stunnel-users] permanent tunnel
by Michal Trojnara 01 Nov '04

01 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Saturday 30 of October 2004 01:16, Ramin Ali Dousti wrote: > You're right in that I don't have persistent TCP connection. I just > want to make sure that the SSL handshake > does not take place with every short-lived connection. You don't want to negotiate new keys for every connection, right? In SSL there's a mechanism for it called "session cache". In stunnel you can increase the timeout for session cache with "session" option (on both client and sever). Just set it to a very high value (a month? a year?). The default is 300 seconds (5 minutes). Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBg0Kf/NU+nXTHMtERAl0mAKDODCg+9LwUVoBfx+i6ou7iYmjgcQCfYprS Mv3KKdhQTUcs81yIw/KNT70= =NWHN -----END PGP SIGNATURE-----

2 2

VPN with windows
by Angelo Raspanti 30 Oct '04

30 Oct '04

I have experimented with succes to use stunnel for make a VPN between two PC with linux.It work with start pppd on both sides when the SSL negotiation is termined with success. At this time server and client sides launch the pppd daemon and the connecction with IP address read from pppd command line (written in config file of stunnel) is made. To make a VPN with two linux BOX is easily ! But if one of the two sides is a Windows plattaform ? I think that the use of this tecnique is noot possible. How to make un VPN between a Linux Plattaform and a Windows plattaform ? Is possible ? Thanks in advance and sorry for my bad english

1 0

RE: [stunnel-users] Stunnel & Java SSL
by richard＠oversight.co.nz 30 Oct '04

30 Oct '04

Managed to sort this issue out by upgrading my JVM to 1.5.0 and adding the certificated in under the Java control panel. Ran into another problem afterwards with my application generating an UNKNOWN PROTOCOL error on the 3rd TCP session after successfully accepting the first two... very strange. I think I'm going to have to give up on the idea of using Java's or IE's SSL system and use Stunnel as a client too. Found a great GUI for Stunnel on Mac OS X called SSL Enabler, shame theres not one as nice for Windows! Richard Watson > Upgrade your OpenSSL package for a start... it's up to .9.7d, tho I use > .9.7a. Re-compile OpenSSL on your machine... try then. > > Did you download a binary of STunnel? > > -----Original Message----- > From: stunnel-users-bounces(a)mirt.net > [mailto:stunnel-users-bounces@mirt.net] On Behalf Of > richard(a)oversight.co.nz > Sent: Friday, 29 October 2004 11:47 a.m. > To: stunnel-users(a)mirt.net > Subject: [stunnel-users] Stunnel & Java SSL > > I'm developing a website where a java applet is downloaded over an > https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu > PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. > The applet codebase in the html code is set to > https://x.x.x.x:1080/xxxx.jar > > To complicate this issue, Stunnel is set to verify=3 i.e. it requires a > valid client certificate. > It seems that the java implementation of SSL (JVM 1.4.1_03) won't > respond to prompts for client certificates?? > Stunnel simply times out with the following error.... > > 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from > 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in > non-blocking mode > 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) > 2004.10.29 11:45:34 LOG7[6898:7171]: service started > 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from > 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state > (accept): before/accept initialization2004.10.29 11:45:34 > LOG7[6898:7171]: waitforsocket: FD=10, DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read > client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): > SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL > state (accept): SSLv3 write > certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): > SSLv3 write > certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state > (accept): SSLv3 flush data > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no > certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, > DIR=read > 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok > 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: > handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: > 140890C7: > error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not > return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service > finished (0 left) > > Does anyone know a way around this? > > Thank you, > > Richard Watson > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

permanent tunnel
by Ramin Dousti 30 Oct '04

30 Oct '04

Hello, I'd like to set up an stunnel between two hosts which currently talk to each other unencrypted. The communication between these two hosts is HTTP and sporadic. What I'd like to achieve is a permanent stunnel between the hosts regardless of their communiucation pattern. Is this possible? And if yes, how? The current setup utilizes stunnel in server mode on the server side and stunnel in client mode on the client side. When a client issues a request, I see that an SSL tunnel is set up between the hosts and after the reception of the reply, the SSL tunnel is torn down. So, the question is, how can I nail down the SSL tunnel to be permanent? Thank you in advance, Ramin

2 1

SSL read returned WANT_: retrying
by Hacker, Dietmar 29 Oct '04

29 Oct '04

Has anybody a solution to this problem ? There was a thread about this msg in June. I am using a central Source staging server for my windows applications accessed via stunnel from remote over a Linux stunnel on the Internet gateway. Centrally I use SuSE Linux 8.2 with stunnel 4.04 and on the clients the current 4.05 windows binary version (also does not work with the older 4.04 windows binary version). The "SourceSave" Software does a directory comparision and then a download of all changed components. Without stunnel no problem. With stunnel after some traffic I always get "SSL returned WANT_: retrying" in the stunnel window and then the software stops downloading. Mit freundlichen Gruessen / With regards Dipl. Ing. Dietmar Hacker Grazer Wechselseitige Versicherung AG A-8010 Graz, Herrengasse 18-20 Tel.: +43 (316) 8037-256 Fax.: +43 (316) 8037-1256 mailto:dietmar.hacker@grawe.at

2 1

Stunnel & Java SSL
by richard＠oversight.co.nz 29 Oct '04

29 Oct '04

I'm developing a website where a java applet is downloaded over an https session provided by Stunnel (stunnel 4.04 on i586-pc-linux-gnu PTHREAD with OpenSSL 0.9.6c 21 dec 2001) running on port 1080. The applet codebase in the html code is set to https://x.x.x.x:1080/xxxx.jar To complicate this issue, Stunnel is set to verify=3 i.e. it requires a valid client certificate. It seems that the java implementation of SSL (JVM 1.4.1_03) won't respond to prompts for client certificates?? Stunnel simply times out with the following error.... 2004.10.29 11:45:34 LOG7[6881:1024]: service accepted FD=10 from 192.168.1.2:19302004.10.29 11:45:34 LOG7[6881:1024]: FD 10 in non-blocking mode 2004.10.29 11:45:34 LOG7[6897:6146]: service finished (0 left) 2004.10.29 11:45:34 LOG7[6898:7171]: service started 2004.10.29 11:45:34 LOG5[6898:7171]: service connected from 192.168.1.2:1930 2004.10.29 11:45:34 LOG7[6898:7171]: SSL state (accept): before/accept initialization2004.10.29 11:45:34 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 read client hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write server hello A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 write certificate request A2004.10.29 11:45:39 LOG7[6898:7171]: SSL state (accept): SSLv3 flush data 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (read): warning: no certificate2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: FD=10, DIR=read 2004.10.29 11:45:39 LOG7[6898:7171]: waitforsocket: ok 2004.10.29 11:45:39 LOG7[6898:7171]: SSL alert (write): fatal: handshake failure2004.10.29 11:45:39 LOG3[6898:7171]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate2004.10.29 11:45:39 LOG7[6898:7171]: service finished (0 left) Does anyone know a way around this? Thank you, Richard Watson

1 0

Session resumption
by Rick Cone, Secure Payment Systems 28 Oct '04

28 Oct '04

I use Stunnel 4.03 I have been working on a project with some slow POS equipment trying to do SSL connections. Because of the slow processors on these devices, we are trying to speed up the connection and transaction. The concept of "session resumption" came up. What is the best way to setup Stunnel to make subsequent connections faster with session resumption. Thanks, Rick Cone Secure Payment Systems 801 8th St. #150-D Greeley, CO 80631 970-352-9434 (office) 970-352-0122 (fax, call office first) rcone(a)securepaymentsystems.com Note: This electronic message and attachments, if any, contain information which is intended solely for the designated recipients. Unauthorized disclosure, copying, distribution, or other use of the contents of this message or attachments, in whole or in part, is prohibited without express authorization of the author of this message.

2 1

Connection crypted with pppd
by angelo.raspanti 28 Oct '04

28 Oct '04

Mike wrote >Using chroot with exec is not trivial. Please make sure you know what >your're trying to do. 8-) OK, i have skip this argument, now i study better it and retry with a new configuration. Thanks

1 0

Outlook has problems with sending email
by Kenneth Simpson 27 Oct '04

27 Oct '04

Hi - I'm having problems with Stunnel 4.05 and Outlook - but not with Mozilla/Thunderbird. Unfortantely, most of our users use Outlook from Office 2000 and Office XP. The problem is Outlook can't send email when using SIMAP/SSMTP. If the remote users set their SMTP server to be their ISP, then Outlook doesn't have a problem. It suggests a sendmail issue except Mozilla/Thunderbird work fine. How do most people configure stunnel for Outlook? We're behind a screening router and port 587 - the so-called sendmail "submission" port - is currently closed. All ICMP is administratively disabled for this host at the router. But sendmail on this particular host is configured for port 587 behind the firewall. Is there a need to configure stunnel for port 587 too? We're using OpenSSL 0.9.7d Sendmail 8.12.10 Stunnel 4.0.5 SPARC Solaris 5.8 Enclosed is the stunnel.conf file. Under version 3.x roughly year ago things appeared to be working correctly - but we've upgraded both sendmail and SSL since then - and our users where migrating from Outlook Express to Outlook. Any ideas? I've added the options options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTbusy = 300 TIMEOUTclose = 60 TIMEOUTidle = 43200 but no help. Any help would greatly appreciated! -- Ken

2 1