stunnel-users June 2005

stunnel-users@stunnel.org

36 participants
51 discussions

[BUG] Stunnel 4.10 + xinetd : Connection reset by peer
by Eric Piel 02 Sep '05

02 Sep '05

Hello, I've upgraded to stunnel 4.10 yesterday and since this time I can't managed to get stunnel working with xinetd. I try to access a CVS server with ssl encryption. If stunnel is started as stand-alone, it works as before, but when it's started by xinetd all I get is: cvs [update aborted]: reading from server: Connection reset by peer I've attached the connection logs with 4.09 and 4.10 as well as my configuration file (which used to work for more than a year). My xinetd is version 2.3.13 (and I haven't changed it for several months). Please, let me know if I'm overlooking at something or if I can try anything to debug more in depth... Thanks in advance, Eric PS: actually the CVS is accesible from outside, so you might want to try yourself! # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = root setgid = root # Authentication stuff verify = 2 CAfile = /etc/ssl/stunnel/lifl-cvs.pem # Use it for client mode client = yes #debug = 7 #output = /home/eric/busy/stunnel.log connect = cvs.lifl.fr:2405

4 5

4.10 Crashes with Multiple Connections
by Eddie Atherton 30 Jun '05

30 Jun '05

Hi. Just started to use stunnel for NNTP traffic to Giga on a gateway Linux 2.4 box that sits between Windows and my cable modem. The NewsReader I use is configured to open 4 connections at the same time. Downloaded and installed 4.10, then immediately hit the -lpthread problem. Edited the Makefile, did a "make clean", "make", and "make install". Tried again. Got an immediate crash. Tried a few more times. Sometimes it crashed, other times the NewsReader reported one connection as working, one as connected, but not pulling any data, and two connections as connecting. So, it looks like everything works with only one active connection, but it segfaults when 2 or more threads are pulling data. The problem is, I can't always get it to crash. Plus, cpu use of stunnel sometimes pegs at 99%, even after closing the connections, and again this isn't consistent. When I turn debug on, it has always only used one active connection, so I don't get the crash. Plus, when debug is on, and I terminate the connections from the NewsReader, the log file expanded to 18meg in less than a minute. I then downloaded and installed 4.9, and this appears to handle the 4 active connections without any problems. Any suggestions as to what kind of information I should try and collect for this. Cheers, Eddie

1 0

SSL_read returned WANT_ - retry
by Leach, Rich 30 Jun '05

30 Jun '05

Greetings all- I'm an internet developer (mainly ColdFusion, some Windows, database stuff, etc.) and I've just inherited a Windows system that is utilizing Stunnel (I believe it's version 3.4) and in the log files I'm seeing this error all over the place: "SSL_read returned WANT_ - retry" It's usually listed around other messages in the log file such as "socket closed", "connection closed", etc. I noticed these messages in our logs because I got a call to restart our web services; everything froze up and the site would not come up. I stopped and started the web services and everything came back up. For a long time everyone around here has been blaming our ColdFusion server (version 6.1) but it looks to me like the Stunnel is throwing a wrench and halting everything - does anyone know what these errors mean or could you direct me to a place on the stunnel site that could offer some insight? I tried looking around the FAQ section but didn't see my error listed. Any help or input you could provide would be most appreciated! Many thanks in advance, Rich

1 0

win32 help
by chris rheinherren 28 Jun '05

28 Jun '05

I am running a win32 based IRC server and I wanted to add SSL to it. I have stunnel up and running. I have the necessary dlls installed. And I have found various help pages on creating the config file. And lastly my irc client is capable of connecting to SSL based servers. so here is my config file: <---- beging ------> RNDfile = C:\stunnel-prnd.txt RNDoverwrite = yes debug = 7 output = C:\stunnel.log [irc] accept = 66.98.154.87:994 connect = 127.0.0.1:994 <---- ending -----> And here is the log outup to help figure out what is wrong as well. <---- log -----> 2005.06.27 21:38:46 LOG5[2364:4084]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7c 30 Sep 2003 2005.06.27 21:38:46 LOG7[2364:3120]: RAND_status claims sufficient entropy for the PRNG 2005.06.27 21:38:46 LOG6[2364:3120]: PRNG seeded successfully 2005.06.27 21:38:46 LOG7[2364:3120]: Certificate: stunnel.pem 2005.06.27 21:38:46 LOG7[2364:3120]: Key file: stunnel.pem 2005.06.27 21:38:46 LOG5[2364:3120]: WIN32 platform: 30000 clients allowed 2005.06.27 21:38:46 LOG7[2364:3120]: FD 132 in non-blocking mode 2005.06.27 21:38:46 LOG7[2364:3120]: SO_REUSEADDR option set on accept socket 2005.06.27 21:38:46 LOG7[2364:3120]: irc bound to 66.98.154.87:994 2005.06.27 21:39:43 LOG7[2364:3120]: irc accepted FD=144 from 12.216.55.121:1583 2005.06.27 21:39:43 LOG7[2364:3120]: FD 144 in non-blocking mode 2005.06.27 21:39:43 LOG7[2364:396]: irc started 2005.06.27 21:39:43 LOG5[2364:396]: irc connected from 12.216.55.121:1583 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): before/accept initialization 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=144, DIR=read 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: ok 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 flush data 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=144, DIR=read 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: ok 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:39:43 LOG7[2364:396]: SSL state (accept): SSLv3 flush data 2005.06.27 21:39:43 LOG7[2364:396]: 1 items in the session cache 2005.06.27 21:39:43 LOG7[2364:396]: 0 client connects (SSL_connect()) 2005.06.27 21:39:43 LOG7[2364:396]: 0 client connects that finished 2005.06.27 21:39:43 LOG7[2364:396]: 0 client renegotiatations requested 2005.06.27 21:39:43 LOG7[2364:396]: 1 server connects (SSL_accept()) 2005.06.27 21:39:43 LOG7[2364:396]: 1 server connects that finished 2005.06.27 21:39:43 LOG7[2364:396]: 0 server renegotiatiations requested 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache hits 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache misses 2005.06.27 21:39:43 LOG7[2364:396]: 0 session cache timeouts 2005.06.27 21:39:43 LOG6[2364:396]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:39:43 LOG7[2364:396]: FD 164 in non-blocking mode 2005.06.27 21:39:43 LOG7[2364:396]: irc connecting 127.0.0.1:994 2005.06.27 21:39:43 LOG7[2364:396]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:39:43 LOG7[2364:396]: waitforsocket: FD=164, DIR=write 2005.06.27 21:44:43 LOG7[2364:396]: waitforsocket: timeout 2005.06.27 21:44:43 LOG3[2364:396]: Failed to initialize remote connection 2005.06.27 21:44:43 LOG7[2364:396]: irc finished (0 left) 2005.06.27 21:44:47 LOG7[2364:3120]: irc accepted FD=180 from 12.216.55.121:1639 2005.06.27 21:44:47 LOG7[2364:3120]: FD 180 in non-blocking mode 2005.06.27 21:44:47 LOG7[2364:768]: irc started 2005.06.27 21:44:47 LOG5[2364:768]: irc connected from 12.216.55.121:1639 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): before/accept initialization 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=180, DIR=read 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: ok 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 flush data 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=180, DIR=read 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: ok 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:44:47 LOG7[2364:768]: SSL state (accept): SSLv3 flush data 2005.06.27 21:44:47 LOG7[2364:768]: 2 items in the session cache 2005.06.27 21:44:47 LOG7[2364:768]: 0 client connects (SSL_connect()) 2005.06.27 21:44:47 LOG7[2364:768]: 0 client connects that finished 2005.06.27 21:44:47 LOG7[2364:768]: 0 client renegotiatations requested 2005.06.27 21:44:47 LOG7[2364:768]: 2 server connects (SSL_accept()) 2005.06.27 21:44:47 LOG7[2364:768]: 2 server connects that finished 2005.06.27 21:44:47 LOG7[2364:768]: 0 server renegotiatiations requested 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache hits 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache misses 2005.06.27 21:44:47 LOG7[2364:768]: 0 session cache timeouts 2005.06.27 21:44:47 LOG6[2364:768]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:44:47 LOG7[2364:768]: FD 148 in non-blocking mode 2005.06.27 21:44:47 LOG7[2364:768]: irc connecting 127.0.0.1:994 2005.06.27 21:44:47 LOG7[2364:768]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:44:47 LOG7[2364:768]: waitforsocket: FD=148, DIR=write 2005.06.27 21:49:47 LOG7[2364:768]: waitforsocket: timeout 2005.06.27 21:49:47 LOG3[2364:768]: Failed to initialize remote connection 2005.06.27 21:49:47 LOG7[2364:768]: irc finished (0 left) 2005.06.27 21:49:51 LOG7[2364:3120]: irc accepted FD=168 from 12.216.55.121:1689 2005.06.27 21:49:51 LOG7[2364:3120]: FD 168 in non-blocking mode 2005.06.27 21:49:51 LOG7[2364:2508]: irc started 2005.06.27 21:49:51 LOG5[2364:2508]: irc connected from 12.216.55.121:1689 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): before/accept initialization 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=168, DIR=read 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: ok 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 flush data 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=168, DIR=read 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: ok 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:49:51 LOG7[2364:2508]: SSL state (accept): SSLv3 flush data 2005.06.27 21:49:51 LOG7[2364:2508]: 3 items in the session cache 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client connects (SSL_connect()) 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client connects that finished 2005.06.27 21:49:51 LOG7[2364:2508]: 0 client renegotiatations requested 2005.06.27 21:49:51 LOG7[2364:2508]: 3 server connects (SSL_accept()) 2005.06.27 21:49:51 LOG7[2364:2508]: 3 server connects that finished 2005.06.27 21:49:51 LOG7[2364:2508]: 0 server renegotiatiations requested 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache hits 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache misses 2005.06.27 21:49:51 LOG7[2364:2508]: 0 session cache timeouts 2005.06.27 21:49:51 LOG6[2364:2508]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:49:51 LOG7[2364:2508]: FD 156 in non-blocking mode 2005.06.27 21:49:51 LOG7[2364:2508]: irc connecting 127.0.0.1:994 2005.06.27 21:49:51 LOG7[2364:2508]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:49:51 LOG7[2364:2508]: waitforsocket: FD=156, DIR=write 2005.06.27 21:54:51 LOG7[2364:2508]: waitforsocket: timeout 2005.06.27 21:54:51 LOG3[2364:2508]: Failed to initialize remote connection 2005.06.27 21:54:51 LOG7[2364:2508]: irc finished (0 left) 2005.06.27 21:54:55 LOG7[2364:3120]: irc accepted FD=164 from 12.216.55.121:1747 2005.06.27 21:54:55 LOG7[2364:3120]: FD 164 in non-blocking mode 2005.06.27 21:54:55 LOG7[2364:460]: irc started 2005.06.27 21:54:55 LOG5[2364:460]: irc connected from 12.216.55.121:1747 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): before/accept initialization 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 flush data 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: FD=164, DIR=read 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: ok 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:54:55 LOG7[2364:460]: SSL state (accept): SSLv3 flush data 2005.06.27 21:54:55 LOG7[2364:460]: 4 items in the session cache 2005.06.27 21:54:55 LOG7[2364:460]: 0 client connects (SSL_connect()) 2005.06.27 21:54:55 LOG7[2364:460]: 0 client connects that finished 2005.06.27 21:54:55 LOG7[2364:460]: 0 client renegotiatations requested 2005.06.27 21:54:55 LOG7[2364:460]: 4 server connects (SSL_accept()) 2005.06.27 21:54:55 LOG7[2364:460]: 4 server connects that finished 2005.06.27 21:54:55 LOG7[2364:460]: 0 server renegotiatiations requested 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache hits 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache misses 2005.06.27 21:54:55 LOG7[2364:460]: 0 session cache timeouts 2005.06.27 21:54:55 LOG6[2364:460]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:54:55 LOG7[2364:460]: FD 144 in non-blocking mode 2005.06.27 21:54:55 LOG7[2364:460]: irc connecting 127.0.0.1:994 2005.06.27 21:54:55 LOG7[2364:460]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:54:55 LOG7[2364:460]: waitforsocket: FD=144, DIR=write 2005.06.27 21:59:55 LOG7[2364:460]: waitforsocket: timeout 2005.06.27 21:59:55 LOG3[2364:460]: Failed to initialize remote connection 2005.06.27 21:59:55 LOG7[2364:460]: irc finished (0 left) 2005.06.27 21:59:59 LOG7[2364:3120]: irc accepted FD=148 from 12.216.55.121:1813 2005.06.27 21:59:59 LOG7[2364:3120]: FD 148 in non-blocking mode 2005.06.27 21:59:59 LOG7[2364:2240]: irc started 2005.06.27 21:59:59 LOG5[2364:2240]: irc connected from 12.216.55.121:1813 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): before/accept initialization 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=148, DIR=read 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: ok 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read client hello A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write server hello A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write certificate A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write server done A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 flush data 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=148, DIR=read 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: ok 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read client key exchange A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 read finished A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write change cipher spec A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 write finished A 2005.06.27 21:59:59 LOG7[2364:2240]: SSL state (accept): SSLv3 flush data 2005.06.27 21:59:59 LOG7[2364:2240]: 5 items in the session cache 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client connects (SSL_connect()) 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client connects that finished 2005.06.27 21:59:59 LOG7[2364:2240]: 0 client renegotiatations requested 2005.06.27 21:59:59 LOG7[2364:2240]: 5 server connects (SSL_accept()) 2005.06.27 21:59:59 LOG7[2364:2240]: 5 server connects that finished 2005.06.27 21:59:59 LOG7[2364:2240]: 0 server renegotiatiations requested 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache hits 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache misses 2005.06.27 21:59:59 LOG7[2364:2240]: 0 session cache timeouts 2005.06.27 21:59:59 LOG6[2364:2240]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.06.27 21:59:59 LOG7[2364:2240]: FD 180 in non-blocking mode 2005.06.27 21:59:59 LOG7[2364:2240]: irc connecting 127.0.0.1:994 2005.06.27 21:59:59 LOG7[2364:2240]: remote connect #1: EWOULDBLOCK: retrying 2005.06.27 21:59:59 LOG7[2364:2240]: waitforsocket: FD=180, DIR=write <--- end log -----> Any help that gets this working would be great. Thanks

2 1

Re: [stunnel-users] Transparent client IP on Windows
by Michal Trojnara 28 Jun '05

28 Jun '05

"Paul Jones" <jonesy_boy10(a)hotmail.com> wrote: > Apparently this can be enabled on Linux with the -T argument. Does anyone > know if (and how) this is somehow possible on Windows? Implementing a transparent proxy on Windows (Winsock) requires a process to globaly intercept Winsock API function. It's a lame, MSDOS-like solution that I'm not going to support. Best regards, Mike

1 0

Transparent client IP on Windows
by Paul Jones 28 Jun '05

28 Jun '05

Hi all, I've read (and tested for myself) on a few sites that Stunnel does not transparently pass the IP of the connecting client to the server app. My server app thinks all connecting clients are coming from IP 127.0.01. Apparently this can be enabled on Linux with the -T argument. Does anyone know if (and how) this is somehow possible on Windows? Cheers. Paul _________________________________________________________________ REALESTATE: biggest buy/rent/share listings http://ninemsn.realestate.com.au

1 0

Stunnel 4.09 exits unexpected on solaris 2.8
by edonald1＠rochester.rr.com 27 Jun '05

27 Jun '05

Hi, I am running the following version of Stunnel: ./stunnel -version stunnel 4.09 on sparc-sun-solaris2.8 PTHREAD+POLL+IPv4 with OpenSSL 0.9.6m 17 Mar 2004 Global options cert = /apps/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH debug = 5 key = /apps/stunnel/etc/stunnel/stunnel.pem pid = /apps/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds It is compiled with pthreads and without TCPwrappers. I am using it to tunnel a mod_jk connection between apache and tomcat. It works perfectly in my Development and QA environment ( runs for weeks on end). When I moved it to production it started not to work so well. Stunnel would mysterious stop working on the server side (procesd disappears). There are no errors in the log whatsoever and the log level is set at 7. One difference in my production environment is that there are multiple clients (apache) and one server (tomcat). All Thoughts are welcome. Thank You

1 0

Errors sending email thru gmail's smtp server
by Melinda Chin 27 Jun '05

27 Jun '05

Hi, I have written an email client application to send/receive email. However, gmail accounts requires that email clients use SSL. In order to do this, I am running stunnel in the background. I am able to retrieve emails from gmail pop3 server, but I am not able To send email thru gmail smtp server. Gmail requires that email clients Support SMTP authentication, and also requires TLS. I am receiving the following errors in stunnel.log when trying to send email from gmail accounts. Attached is my stunnel.conf file. Is there something I am missing to cause these errors ? Does stunnel support SMTP authentication ? - Melinda 2005.06.27 11:26:17 LOG7[25398:81923]: <- 220 2.0.0 Ready to start TLS. 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): before/connect initialization 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write client hello A 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: FD=13, DIR=read 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: ok 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server hello A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server certificate A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read server done A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write client key exchange A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write change cipher spec A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 write finished A 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 flush data 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: FD=13, DIR=read 2005.06.27 11:26:17 LOG7[25398:81923]: waitforsocket: ok 2005.06.27 11:26:17 LOG7[25398:81923]: SSL state (connect): SSLv3 read finished A 2005.06.27 11:26:17 LOG7[25398:81923]: 5 items in the session cache 2005.06.27 11:26:17 LOG7[25398:81923]: 5 client connects (SSL_connect()) 2005.06.27 11:26:17 LOG7[25398:81923]: 5 client connects that finished 2005.06.27 11:26:17 LOG7[25398:81923]: 0 client renegotiatations requested 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server connects (SSL_accept()) 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server connects that finished 2005.06.27 11:26:17 LOG7[25398:81923]: 0 server renegotiatiations requested 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache hits 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache misses 2005.06.27 11:26:17 LOG7[25398:81923]: 0 session cache timeouts 2005.06.27 11:26:17 LOG6[25398:81923]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.06.27 11:26:18 LOG7[25398:81923]: Socket closed on read 2005.06.27 11:26:18 LOG7[25398:81923]: SSL alert (write): warning: close notify 2005.06.27 11:26:18 LOG7[25398:81923]: SSL write shutdown (output buffer empty) 2005.06.27 11:26:19 LOG7[25398:81923]: SSL socket closed on SSL_read 2005.06.27 11:26:19 LOG5[25398:81923]: Connection closed: 59 bytes sent to SSL, 165 bytes sent to socket 2005.06.27 11:26:19 LOG7[25398:81923]: ssmtp finished (1 left)

1 0

Passphrase validation
by Peter Pentes 27 Jun '05

27 Jun '05

Hi, As I understand it, Stunnel does not currently support the validation of certificate passphrases. For example, to make a connection from the client to the server, no passphrase is requested when a certificate is selected. Are there any plans for this feature to be added to Stunnel? Regards, PP __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

3 5

Have extra bandwidth. does stunnel need a mirror?
by christopher＠baus.net 27 Jun '05

27 Jun '05

I have extra bandwidth. Does stunnel need a mirror? I'm using stunnel exclusively for my SSL needs. I works great, and I just want to give back. Christopher Baus

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users June 2005