April 2005 - stunnel-users

Unexpected closed connections
by Rory Campbell-Lange 11 Apr '05

11 Apr '05

Hi Everyone We have been very happily using stunnel for about 5 months connecting a site office back to a main office, tunnelling imap connections. We are suddenly seeing lots of disconnection messages and people at a. can no longer see their mail on d. The server suffers a "socket write shutdown" condition and shuts down the associated process. We have restarted the routers and firewalls and all seems to be working fine, other than stunnel. I'd be grateful for any insight or further help. Many thanks Rory Present arrangement: a. site client | b. site server port forwarded to c. | | internet | | c. main office server port forwarded to d. | d. imap server Server b forwards imap connections securely to the main office server, which then passes on on the imap connections to the imap server. Server b connects through the following inetd line: imaph stream tcp nowait nobody /usr/sbin/stunnel /usr/sbin/stunnel -c -r server_c_address:imap We are running version 3.26 on debian: stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Server shows following disconnect messages: 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (read): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL closed on SSL_read 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (write): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG7[13320:163848]: Socket write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG5[13320:163848]: Connection closed: 92 bytes sent to SSL, 0 bytes sent to socket 2005.04.11 13:21:46 LOG7[13320:163848]: 10.0.0.24.imap finished (6 left) Client logs: Apr 11 15:50:26 hald stunnel[4672]: server_b.imaps connected from 10.0.1.54:49301 Apr 11 15:55:05 hald stunnel[4672]: SSL_connect: Peer suddenly disconnected ... Apr 11 15:49:55 hald stunnel[4655]: 195.172.252.146.imaps connected from 10.0.1.52:49819 Apr 11 15:54:08 hald stunnel[4655]: SSL_connect: Peer suddenly disconnected -- Rory Campbell-Lange <rory(a)campbell-lange.net> <www.campbell-lange.net>

1 0

Re: [stunnel-users] Pass IP Attn: Alexander Lazic
by Tim Brown 10 Apr '05

10 Apr '05

Nope...I see Cygwin is a Linux-like environment for Windows. Can you send me the stunnel.exe that already has this patch compiled? This works for windows? thanks. ----- Original Message ----- From: "Alexander Lazic" <al-stunnel(a)none.at> To: "Tim Brown" <tbrown2376(a)adelphia.net> Sent: Sunday, April 10, 2005 12:06 PM Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic > On Son 10.04.2005 10:24, Tim Brown wrote: >>Al....not following how to do this from Windows..cmd prompt? > > Don't you use cygwin? > > al ;-) > >>From: "Alexander Lazic" <al-stunnel(a)none.at> >>To: "Tim Brown" <tbrown2376(a)adelphia.net> >>Cc: <stunnel-users(a)mirt.net> >>Sent: Sunday, April 10, 2005 4:28 AM >>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >> >> >>>On Son 10.04.2005 00:33, Tim Brown wrote: >>>>Al...how do I install this patch? ...I running stunnel 4.07 >>> >>>Have you ever used the program 'patch'? >>> >>>>Thanks for your help. >>> >>>get stunnel-4.07.tar.gz >>>extract stunnel-4.07.tar.gz >>>get the patch >>>call patch -p0 < the_patch_file >>> >>>al ;-) >>> >>>>From: "Alexander Lazic" <al-stunnel(a)none.at> >>>>To: <tbrown2376(a)adelphia.net> >>>>Cc: <stunnel-users(a)mirt.net> >>>>Sent: Saturday, April 09, 2005 3:54 AM >>>>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >>>> >>>> >>>>>Hi, >>>>> >>>>>On Fre 08.04.2005 12:48, tbrown2376(a)adelphia.net wrote: >>>>>>Attn: Alexander Lazic >>>>>> >>>>>>Can you please send me the patch for: >>>>>>patch for HTTP => X-Forwarded-For Header >>>>>> >>>>>>to: tbrown2376(a)adelphia.net >>>>> >>>>>You can get it from: >>>>> >>>>>http://stunnel.mirt.net/pipermail/stunnel-users/2005-February/000331.html >>>>> >>>>>or you can wait for monday, then i can send you the patch. >>>>> >>>>>al ;-) >>>>> >>>>_______________________________________________ >>>>stunnel-users mailing list >>>>stunnel-users(a)mirt.net >>>>http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >>_______________________________________________ >>stunnel-users mailing list >>stunnel-users(a)mirt.net >>http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel 4.09 error message-- s_poll_wait:invalid argurment <WSAEINVAL> <10022>
by Ed Huckins 10 Apr '05

10 Apr '05

Occurs when I upgraded from stunnel 4.08 to 4.09. Using OpenSSL 0.9.7f . Stunnel.conf looks like # We're running as a client to SSLify the POP & IMAP connections client=yes # POP3 service, listens on localhost:11110 [dslx-pop3s] accept=localhost:11110 connect=mail.dslextreme.com:995 What do I need to add when going from 4.08 to 4.09? Everything seems to work; just a reset of the connection occurs instead of a close. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0514-3, 04/10/2005 Tested on: 4/10/2005 10:40:50 AM

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 10 Apr '05

10 Apr '05

Attn: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

3 4

Pass IP Attn: Alexander Lazic
by Tim Brown 09 Apr '05

09 Apr '05

Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-) Tim Brown VP Network Services Florida Telco Credit Union Ph: 904.723.6315 Toll Free: 800.342.2352 ext. 6315 Fax: 904.722.6615 <mailto:tbrown@floridatelco.org> tbrown(a)floridatelco.org Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

3 3

stunnel and NNTP on windows - best practices
by Sir Thanksalot 08 Apr '05

08 Apr '05

Hi all, I am trying to use stunnel for SSL access to a NNTP newserver and found quite a few pages that list ways of doing that. I personally am using xnews as my newsreader, and I have seen variations of the same instructions with different software (Agent, Free Agent for newsreaders, Pegasus Mail as your mail application etc.). For completeness sake, here are some of the ones that I've found - http://www.cotse.net/users/putty/ssl (for Xnews and stunnel 4.x) http://www.geocities.com/d4vidb/x_setup13.html (for Xnews and stunnel 3.x - doesn't use the stunnel.conf file necessary in stunnel 4.x) http://www.noderunner.net/~llin/old/nntp-ssl.html (for a newsreader and stunnel 3.x. It also has links to a stunnel.conf file for stunnel 4.x users) In all these instructions (whether using the stunnel 3.x commandline options or using the stunnel.conf file for stunnel 4.x), I haven't seen any instructions about creating any certificates or public/private keys or a passphrase. Also there doesn't seem to be any writeup on what algorithm actually ends up getting used or even a way to pick which algorithm to use. What's the best practise for users? Should they do anything extra? Set up key pairs? Choose a default algorithm? Thanks. -- _______________________________________________ NEW! Lycos Dating Search. The only place to search multiple dating sites at once. http://datingsearch.lycos.com

1 0

TIMEOUTclose
by Joe Abbey 08 Apr '05

08 Apr '05

Background: I have been having issues getting Entourage to connect with my mail server over POP3S. Entourage will connect, communicate, and then hangs for 60 seconds. According to tcpdumps, Entourage appears to hang until a timeout. Connecting directly to the pop3 daemon, bypassing stunnel, there is no lag. Therefore something appears to be wrond with the stunnel/Entourage interaction. To get Entourage to work with POP3S and have virtually no lag, I've set in my stunnel.conf TIMEOUTclose = 2 for [pop3s]. Question: Is there any reason not to set TIMEOUTclose = 0? Thanks! Joe

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 08 Apr '05

08 Apr '05

ATTN: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

1 0

Compilation error on windows, cannot find "-lssl"
by Billinger Olle 07 Apr '05

07 Apr '05

Hi I'm trying to compile stunnel 4.08 on windows using mingw, with openssl-0.9.7f. I have edited the Makefile.w32 and it compiles ok until it cannot find the "-lssl". Any suggestions are welcome. //Olle ************************************** $ make -f Makefile.w32 stunnel.exe gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o stunnel.o stunnel.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o ssl.o ssl.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o client.o client.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o protocol.o protocol.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o sthreads.o sthreads.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o log.o log.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o options.o options.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o network.o network.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o resolver.o resolver.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o gui.o gui.c gcc -s -o stunnel.exe stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o -L/c/openssl/bin -lwsock32 -lgdi32 -lssl -mwindows c:\mingw\bin\..\lib\gcc-lib\mingw32\3.2.3\..\..\..\..\mingw32\bin\ld.exe: cannot find -lssl make: *** [stunnel.exe] Error 1 My Makefile.w32 ******************* SSLDIR=/c/openssl DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL CFLAGS=-g -O2 -Wall $(DEFINES) -I$(SSLDIR)/include LDFLAGS=-s # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 LIBS=-L$(SSLDIR)/bin -lwsock32 -lgdi32 -lssl OBJS=stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) -mwindows clean: rm *.o rm stunnel.exe #resources.o: resources.rc resources.h # windres resource.rc resources.o $(OBJS): *.h Makefile.w32 *********************

1 0

Stunnel.conf reload
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way, under win32, to have stunnel reload its .conf file and certificates without restarting the service ? (A kind of SIGHUP) Thanks, Phil

1 0