December 2007 - stunnel-users

Re: [stunnel-users] Stunnel on the same machine
by subrata＠indiatimes.com 01 Aug '11

01 Aug '11

The configuration files are : pid = /var/stunnel.pid ;chroot = /var/lib/stunnel setuid = nobody setgid = nobody foreground =yes ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept = 3307 connect = 192.168.1.6:3307 On 192.168.1.6 ---------------------- pid = /var/stunnel.pid setuid =nobody setgid = nobody foreground = yes client = no ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [mysqls] accept =3307 connect =3306 connecting like /usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307 Enter password: On entring password the following lines appear : ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 Subrata ----- Original Message ----- From: Brian Hatch <bri(a)stunnel.org> To: subrata(a)indiatimes.com Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST) Subject: Re: [stunnel-users] Stunnel on the same machine Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted: > After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there. What do your stunnel configuration files look like? Other problem: mysql client may decide to use a local domain socket when connecting to localhost, thwarting your attempts to go via Stunnel. You might want to 'strace mysql ...' and look for the connect() lines. -- Brian Hatch Time flies like an Systems and arrow. Fruit flies Security Engineer like a banana. http://www.ifokr.org/bri/ Every message PGP signed -- My life has changed. What about yours? Log on to the new Indiatimes Mail and Live out of the Inbox!

3 3

Re: [stunnel-users] rewrite Destination: when rewriting Host:
by Brian Hatch 07 Oct '09

07 Oct '09

Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted: > Researching online one can see that WebDAV's spec requires that they > check both src and dest URLs for protocol & port. But with some proxies or > SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as > http and the other as https. Here's one person explaining it, much better > than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml Stunnel doesn't currently have the ability to scan and re-write the plaintext. For HTTP redirects it could possibly be implemented (re-write only the response before ^$, and redirects aren't chunked and don't have content lengths to work with, etc) but you'd still need enough HTTP logic to handle keepalives and such. It's not trivial and not likely. Another option would be to have something already HTTP aware doing the rewriting in between stunnel and subversion. A re-writing proxy. Another option would be to use mod_rewrite in apache to rewrite the urls. But the best way would be to just use SSL inside apache and drop stunnel entirely. -- Brian Hatch The best way to accelerate Systems and a Windows machine is at Security Engineer 9.8 meters per second http://www.ifokr.org/bri/ squared. Every message PGP signed

3 2

Bugs
by Jan.Haering＠rz-kiru.de 29 Feb '08

29 Feb '08

Hallo, I have found 2 Bugs. 1. In Version 4.21: No Taskbar Icon is displayed when the service starts. Although the taskbar ist set in config file (taskbar = yes). 2. In probably all Versions (I have testet 4.18, 4.20 and 4.21) If i started the service over Start -> Programm Files -> stunnel -> Service Start (stunnel -start) no log files are written. If i start the service over services.msc from Windows or "sc start stunnel" log files are written. The icon log displayed the following message in version 4.18 and 4.20 2007.11.09 09:41:03 LOG3[2396:2400]: stunnel.log: Broken pipe (32) 2007.11.09 09:41:03 LOG3[2396:2400]: Unable to open output file: stunnel.log Best Regards Jan

5 9

Missing Something Basic on Config
by Steve 29 Dec '07

29 Dec '07

Using stunnel for NNTPS. Stunnel starts without any apparent problems (log looks normal), but simply doesn't intercept packets from my news reader. There is no activity in the log and sniffing the packets shows everything happening on 119. My understanding of the concept is that there are no configuration changes needed in the newsreader; IOW, I leave it pointing to the unsecured NNTP server with the port set to 119. I fear I'm missing something very obvious. BTW, I've confirmed the ability to use NNTPS with this particular server by using Outlook Express, which is compatible with NNTPS. Version: 4.20; I used the Windows binary. Running XP. Config: ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [nntps] accept = 192.168.1.101:119 connect = secure.news.easynews.com:563 Log: 2007.12.28 22:24:46 LOG5[6640:6644]: stunnel 4.20 on x86-pc-mingw32-gnu with OpenSSL 0.9.8d 28 Sep 2006 2007.12.28 22:24:46 LOG5[6640:6644]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2007.12.28 22:24:46 LOG5[6640:5936]: No limit detected for the number of clients 2007.12.28 22:24:46 LOG7[6640:5936]: FD 196 in non-blocking mode 2007.12.28 22:24:46 LOG7[6640:5936]: SO_REUSEADDR option set on accept socket 2007.12.28 22:24:46 LOG7[6640:5936]: nntps bound to 192.168.1.101:119

1 0

Avoiding outlook express warning...
by fg 28 Dec '07

28 Dec '07

Hello all I use stunnel on a server with a stunnel.pem file generated with openSSL,( this file is not certified with verisign or others...) Each time i launch outlook express on a client a have a warning saying that the server is using a certificate who can't be verified.... I have to close this warning and after all is ok... Question Is it possible to skip this warning? perhaps with a public key approuved in outlook express??? thanks for help --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

3 2

stunnel
by peter griep 28 Dec '07

28 Dec '07

hello i'm using stunnel with download2day,but it's not working wih grabit can you tell what i must do to work stunnel with grabit. peter

3 2

1 tunnel client to few different servers
by Shalvi Ziv 26 Dec '07

26 Dec '07

All, As my PROXY server gets requests from end-users to be proxied to several different content providers (SMS servers), I was wondering how can encrypt the traffic between the PROXY to the SMS using stunnel, but still handle the differentiation to the various content providers. Meaning, my PROXY listens on port 9090 for all incoming SMS requests and each request should be addressed to different SMS server (i.e. different content provider) based on the number the message was sent to. See following example: Client = yes [SMPP] accept = 9090 (should always be this port) connect = <SMS IP>:442 Now, how can I do it with stunnel configuration (having the <SMS IP> flexibly assigned according to other parameters in the packet)? Thanks! zivs

2 1

Can stunnel be configured to listen for multiple IP addresses and access different email hosts?
by David Goldstein 21 Dec '07

21 Dec '07

2 1

Using stunnel as a non-root user
by T. S. Ferreira 20 Dec '07

20 Dec '07

I have a small web application running as a regular (non root) user on my port 6666. I would like to make it accessible through SSL on port 7777. In order to test it I used (as the same non root user) the following command: stunnel -D 7 -p mypemfile.pem -d 7777 -r localhost:6666 but it does not work. When I check with "ps aux | fgrep stunnel", no such program is running. However if I run it as root, it does work. I did not find in the documentation any restriction with this regard. Since my final application will run on a machine to whose root I do not have access, I would like to find a way to solve this problem. Any hint will be appreciated. -- tsf ----------------------------------------- My system data are: (1) Linux/Ubuntu 7.10, kernel 2.6.22-14-generic, (2) Output of "/usr/bin/stunnel4 -version": stunnel 4.20 on i486-pc-linux-gnu with OpenSSL 0.9.8e 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none (3) Output due to '-D 7' option: 2007.12.20 10:00:45 LOG7[14820:3082589872]: Snagged 64 random bytes from /home/tomasz/.rnd 2007.12.20 10:00:45 LOG7[14820:3082589872]: Wrote 1024 new random bytes to /home/tomasz/.rnd 2007.12.20 10:00:45 LOG7[14820:3082589872]: RAND_status claims sufficient entropy for the PRNG 2007.12.20 10:00:45 LOG7[14820:3082589872]: PRNG seeded successfully 2007.12.20 10:00:45 LOG7[14820:3082589872]: Certificate: jai_ssl.pem 2007.12.20 10:00:45 LOG7[14820:3082589872]: Certificate loaded 2007.12.20 10:00:45 LOG7[14820:3082589872]: Key file: jai_ssl.pem 2007.12.20 10:00:45 LOG7[14820:3082589872]: Private key loaded 2007.12.20 10:00:45 LOG7[14820:3082589872]: SSL context initialized for service stunnel3 (4)"/usr/bin/stunnel" is a Perl script whose comments say " ... wrapper to use stunnel 3.x syntax in stunnel >=4.05 ..."; it is version 2.00 (2005.04.2).

1 1

Stunnel never really connects
by Pat Riehecky 20 Dec '07

20 Dec '07

I am trying to send email over stunnel from a client that doesn't support encryption to a server that does. The local socket opens just fine, but it never really seems to connect to the remote server. A tcpdump shows only three packets exchanged between the two systems (Syn, Syn/Ack, Ack). The behavior is the same regardless of which tls enabled port I point stunnel at. I am able to connect to these ports via telnet and send email so I know the connection can be negotiated. I am using the 4.21 build for windows (XP SP2) found on the main webpage. Help! --- stunnel.conf --- ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ; my email client isn't eudora, but given how ; it doesn't support standards like encrypted ; transport..... options = DONT_INSERT_EMPTY_FRAGMENTS ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes [smtp] accept = 127.0.0.1:25 connect = mailserver.mydomain.tld:587 ;connect = mailserver.mydomain.tld:465 ;connect = mailserver.mydomain.tld:25 protocol = smtp

2 1

'PIN' engine control command
by Ludolf Holzheid 14 Dec '07

14 Dec '07

Dear list, I'm trying to use stunnel on Windows with an USB token (`CryptoMate' from ACS). However, I can't manage to make stunnel ask for the token PIN: o Loading the private key works if I specify the PIN in the configuration file (`engineCtrl = PIN:...'). o If there is no `PIN' engine control option in the configuration file, loading the private key fails. The log message are: error stack: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error stack: 800050A0 : error:800050A0:Vendor defined:PKCS11_login:PIN incorrect Do I have to add a special engine control option to the configuration file in order to get asked for the PIN or is it intended to `just work'? Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

2 2

rtmps with stunnel on linux
by David Schulberg 14 Dec '07

14 Dec '07

Hi, Cannot get rtmps working with Firefox (IceWeasel) on Linux. I have rtmps working fine with Firefox and IE on Windows XP. The error I see in stunnel (see below) when I try rtmps through a Linux browser is "peer suddenly disconnected". Also curious that there are 2 attempts made. 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=212 from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2576]: https started 2007.12.13 16:31:41 LOG7[2624:2576]: FD 212 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2576]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2576]: https accepted connection from 124.190.241.7:59728 2007.12.13 16:31:41 LOG7[2624:2576]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2576]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2576]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2576]: https finished (0 left) 2007.12.13 16:31:41 LOG7[2624:1192]: https accepted FD=236 from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:1192]: Creating a new thread 2007.12.13 16:31:41 LOG7[2624:1192]: New thread created 2007.12.13 16:31:41 LOG7[2624:2572]: https started 2007.12.13 16:31:41 LOG7[2624:2572]: FD 236 in non-blocking mode 2007.12.13 16:31:41 LOG7[2624:2572]: TCP_NODELAY option set on local socket 2007.12.13 16:31:41 LOG5[2624:2572]: https accepted connection from 124.190.241.7:59729 2007.12.13 16:31:41 LOG7[2624:2572]: SSL state (accept): before/accept initialization 2007.12.13 16:31:41 LOG3[2624:2572]: SSL_accept: Peer suddenly disconnected 2007.12.13 16:31:41 LOG5[2624:2572]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.13 16:31:41 LOG7[2624:2572]: https finished (0 left) Regards, David Schulberg

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Again, please send your responses to the list.] On Wed, Dec 12, 2007 at 06:18:58PM +0000, Mario Neè wrote: > > On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > > > From: rodrigo(a)nul-unu.com > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > > > like that to the remote 192.168.x.x:443 This means that the remote > > > > Apache needs to be listening on port 443 with ssl enabled there. Is > > > > this what you wanted? > > > > > > yes it's what i want. > > > > > > > Ok. Then I'd guess the problem is that apache is not expecting SSL on > > port 443. Read up on how to enable it. I'd guess a good start is > > http://httpd.apache.org/docs/2.0/mod/mod_ssl.html > > > if i try to connect to 192.168.x.x:443 with firefox everything > works, only with stunnel i get that error Do you try to connect with http://192.168.x.x:443 or with https://192.168.x.x:443 (note the 's')? -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

Re: [stunnel-users] * lencoboy Stunnel client and Centos 5 Apache
by Luis Rodrigo Gallardo Cruz 12 Dec '07

12 Dec '07

[Please, respond to the list, not to the private mail of whoever answers you.] On Wed, Dec 12, 2007 at 05:00:08PM +0000, Mario Neè wrote: > > From: rodrigo(a)nul-unu.com > > On Wed, Dec 12, 2007 at 09:36:35AM +0000, Mario Neè wrote: > > > i'm trying to connect a stunnel client to the welcome page of Apache > > > in Centos 5 (Fresh install with no changes to Apache conf). > > > > > > command to create a client (on Feisty Fawn Ubuntu): > > > sudo stunnel -c -d 1443 -r 192.168.x.x:443 > > > > This takes what is sent to local port 1443, encrypts it, and sends it > > like that to the remote 192.168.x.x:443 This means that the remote > > Apache needs to be listening on port 443 with ssl enabled there. Is > > this what you wanted? > > yes it's what i want. > Ok. Then I'd guess the problem is that apache is not expecting SSL on port 443. Read up on how to enable it. I'd guess a good start is http://httpd.apache.org/docs/2.0/mod/mod_ssl.html -- Rodrigo Gallardo GPG-Fingerprint: 7C81 E60C 442E 8FBC D975 2F49 0199 8318 ADC9 BC28

1 0

newbie config not running
by fuzzy_4711 12 Dec '07

12 Dec '07

Hello list. I am new to stunnel and do have some problems to get it running. The server is a WinXPSP2 behind a router. The router has port forwarding enabled for port 9999 to the stunnel server (4.21). On the same box a vnc server is running on port 5900 which I like to tunnel. Firewall is opened. The netstat -a -n shows the server listening on the desired port (9999). My server config looks like that: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode ;client = yes [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 465 connect = 25 [VNC Server] accept = 9999 connect = 5900 The client side is a linux box with config setting: client = yes [VNC Server] accept = 5900 connect = 9999 I turned on debugging and stunnel.log seems to be okay - no error messages. But I am not able to get an connection. What am I doing wrong? Stefan

5 8

* lencoboy Stunnel client and Centos 5 Apache
by Mario Neè 12 Dec '07

12 Dec '07

Hello, i'm trying to connect a stunnel client to the welcome page of Apache in Centos 5 (Fresh install with no changes to Apache conf). command to create a client (on Feisty Fawn Ubuntu): sudo stunnel -c -d 1443 -r 192.168.x.x:443 if i try to connect to http://localhost:1443 and a look in /var/log/syslog i see this error: SSL_connect: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression. _________________________________________________________________ Ti piace giocare con le lettere? Prova ABCLive! http://messengergiochi.it.msn.com/

2 1

server reads ecrypted data on connect ?
by Nikolaj G. 11 Dec '07

11 Dec '07

Hello stunnel'ers, First of all - im a newbie into openssl and stunnel. Im trying to stunnel between my own java socket server and client. The stunnel is established, but the server reads encrypted data on connect. Since I dont send anything, Im surprised to see encrypted data in the server log. Could someone please help. Ive managed to create a root certificate, a request and signing it, using: http://www.eclectica.ca/howto/ssl-cert-howto.php Thanks in advance. /nikolaj PS see configuration below: ----------------------------------------------- Packages (Fedora Core 6): openssl-devel-0.9.8b-15.fc6 openssl-0.9.8b-15.fc6 stunnel-4.15-2 ----------------------------------------------- The SERVER stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/cacert.pem cert = /root/ssl/key-cert.pem pid = /root/ssl/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes #setuid = stunnel #setgid = stunnel [mystunnel] accept = ratata.cirque.dk:998 connect = 127.0.0.1:8200 ----------------------------------------------- The CLIENT stunnel.conf: ; Certificate/key is needed in server mode CAfile = /root/ssl/eclectica/cacert.pem pid = /root/ssl/eclectica/stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 foreground=yes ; enable client mode client = yes [mystunnel] accept = 127.0.0.1:998 connect = ratata.cirque.dk:8200 ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

HTTPS hardcoded redirects
by Ezio Ostorero 10 Dec '07

10 Dec '07

All, I have a problem similar to the one described in http://mirt.net/pipermail/stunnel-users/2006-October/001324.html i.e. I ***wish*** to use the recording functionalities of JMeter while accessing an apache-SSL-secured Tomcat web server. JMeter does not allow recording on SSL so I have to ... un-cipher my HTTPS sessions, stunnel looks like the right choice. Being an stunnel newbie, I started here: http://www.stunnel.org/examples/https_client.html , this HOWTO looks quite close to my configuration. We have a plain-vanilla tomcat server behind an apache/SSL, and I want to access this web application from an HTTP-only browser. So, I configure stunnel as a "client", I run it on my PC, with the following configuration: [psuedo-https] accept = 8080 connect = <server>:443 TIMEOUTclose = 0 I read it as follows: stunnel talk cleartext HTTP on the local 8080 port and forwards in crypted HTTPS on the <server> port 443 I set the URL in my browser to http://localhost:8080/oi/ and this happens: 1) Ethereal sez that my PC and <server> start an SSLv3 conversation, good, we're on track 2) I have an HTTP analyzer plugged in my browser that shows me the content of the first GET that is a redirect to an SSO server (on the same <server>:443 port) for user authentication https://<server>/ssoserver/login?service=...... 3) My browser then issue a GET to https://<server>/ssoserver/login?service=...... and is GAME OVER, my beloved stunnel is cleanly bypassed by the hardcoded https://<server>/ string Any suggestion? Is it a dead end? Any dirty trick I could play with? Such as running multiple stunnel instances, setting <server> = localhost in my hosts file etc.? Thanks, Ezio -- Ezio Ostorero, Catania Seltz e limone col sale. Arriminatu, non annacatu

1 0

Re: [stunnel-users] Problem compiling win32 stunnel.exe v 4.21
by butterspoon＠gmail.com 10 Dec '07

10 Dec '07

On 09/12/2007, Luis Rodrigo Gallardo Cruz <rodrigo(a)nul-unu.com> wrote: > On Sun, Dec 09, 2007 at 11:30:01PM +0000, Hidden wrote: > > Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux > > 2.6.22.1 as a prelude to applying some patches and I'm getting > > stuck. > > Just to make sure I understand: You are trying to build *for* windows > *in* Debian. Yup, just like the documentation (INSTALL.W32) says: 1) install mingw32 cross-compiler o a Unix/Linux machine (native compilation on a Windows machine is possible, but not supported) [...] 5) type "make stunnel.exe" > You seem to be mixing up (the names of) unix libs with windows ones. Well, something is. I'm just doing it by the book! > Anyways, would it not be easier to compile in windows? Anyone else here build stunnel.exe? What did you use? T

1 0

Problem compiling win32 stunnel.exe v 4.21
by Hidden 10 Dec '07

10 Dec '07

Okay, so I'm trying to build stunnel.exe (ver 4.21) under Debian Linux 2.6.22.1 as a prelude to applying some patches and I'm getting stuck. I've followed the instructions in the makefile – Install mingw32; compile and install openssl; unpack and make stunnel.exe. mingw makes a bunch of object files for a while, but then at the link stage it bombs with i586-mingw32msvc/bin/ld: cannot find -lzdll make was when trying to execute the command: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-0.9.8g -lzdll -leay32 -lssl32 -lws2_32 -lgdi32 -mwindows eay32 is nowhere to be found either. It and ssl32 are clearly related to openssl, but I can't see any suitable files in either the openssl build directory (/usr/src/openssl-0.9.8g as advertised). zdll could be something to do with zlib (which I have, ver 1.2.3) and eay32 and ssl32 are obviously related to openssl, but the only libraries under openssl are libssl.a and libcrypto.a (although optimistically trying to bolt in libssl in place of ssl32 doesn't work). ws2_32 and gdi32 are windows sockets and GDI, for what it's worth. I can't find the required libs on the internet anywhere, and maybe it's all down to me being a novice with mingw. I do notice the tantalizingly named files zlib1.dll, libeay32.dll, and libssl32.dll in the precompiled Windows binary distribution of stunnel, but surely I can't use them in any way? I'd love some help from anyone who knows this system better! Thanks, Tony

2 1

SSL session caching with multiple clients through stunnel to an https server
by Paul McGarry 06 Dec '07

06 Dec '07

Hi there, I have an application where apache/php processes make SOAP requests over https to a single remote server (which is IIS I think). I am trying to cut down the time each request takes. In it's current configuration I think some time will be wasted as the php client and IIS server handshake to set up a new SSL connection for each request, thereby adding (at least) twice the network latency between the two servers to each request. (As far as I can tell there is no way to make php SOAP use some kind of persistant connection or SSL cache when talking to the server) I am wondering if I pushed the soap requests as http through stunnel whether stunnel would be more efficient with SSL connections or whether it will just create a new tunnel with a new ssl session for each request it receives? Does anyone have any advice? Paul

1 0

MS Outlook verify = 2 using problem
by FFT` 05 Dec '07

05 Dec '07

Good Day! I'm using Stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 with OpenSSL 0.9.8g 19 Oct 2007 on Fedora-like Linux server. stunnel.conf consists: _______________________________________________________________________________ cert = /usr/local/etc/stunnel/server.crt key = /usr/local/etc/stunnel/server.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath =/usr/local/etc/stunnel/certs ; It's often easier to use CAfile CAfile = /usr/local/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crl.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Service-level configuration [pop3s] accept = 995 connect = 110 ________________________________________________________________________ PKI consists: ROOT_CA CA MAIL_CON_CA SERVER CLIENT server.crt - Server certificate in PEM Format; server.pem - Server key in PEM Format with nopassword ca.pem - ROOT_CA, CA, MAIL_CON_CA certificates in PEM format. When I am using MS Outlook mail Client , there are some PROBLEM with connections to SERVER:995 stunnel.log consists: ______________________________________________ 2007.12.05 14:57:39 LOG5[16668:1074107776]: stunnel 4.21 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2007.12.05 14:57:39 LOG5[16668:1074107776]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2007.12.05 14:57:39 LOG6[16668:1074107776]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.12.05 14:57:39 LOG6[16668:1074107776]: poll() used - no FD_SETSIZE limit for file descriptors 2007.12.05 14:57:39 LOG5[16668:1074107776]: 500 clients allowed 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 6 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 8 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: FD 9 in non-blocking mode 2007.12.05 14:57:39 LOG7[16668:1074107776]: SO_REUSEADDR option set on accept socket 2007.12.05 14:57:39 LOG7[16668:1074107776]: pop3s bound to 0.0.0.0:995 2007.12.05 14:57:39 LOG7[16669:1074107776]: Created pid file /stunnel.pid 2007.12.05 14:57:48 LOG7[16669:1074107776]: pop3s accepted FD=10 from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s started 2007.12.05 14:57:48 LOG7[16669:1074228016]: FD 10 in non-blocking mode 2007.12.05 14:57:48 LOG7[16669:1074228016]: TCP_NODELAY option set on local socket 2007.12.05 14:57:48 LOG5[16669:1074228016]: pop3s accepted connection from 192.168.1.205:2129 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): before/accept initialization 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 read client hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write server hello A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 write certificate request A 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL state (accept): SSLv3 flush data 2007.12.05 14:57:48 LOG7[16669:1074228016]: SSL alert (write): fatal: handshake failure 2007.12.05 14:57:48 LOG3[16669:1074228016]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate 2007.12.05 14:57:48 LOG5[16669:1074228016]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.12.05 14:57:48 LOG7[16669:1074228016]: pop3s finished (0 left) ______________________________________________ I load all Server, CA , and client certificate in SYSTEM, but there is NO Connection. Please help Me with Stunnel and Outlook using.

1 0

(no subject)
by Harmon, Paul 02 Dec '07

02 Dec '07

Ok Guys, I hate to be a nuisance. But I encountered an error coming out o the Stunnel configuration in LINUX. First what does it mean when Stunnel is in INETD mode? Does this imply certain configuration restrictions and why? Thanks, Paul Harmon

2 1