The configuration files are :
pid = /var/stunnel.pid
;chroot = /var/lib/stunnel
setuid = nobody
setgid = nobody
foreground =yes
; Use it for client mode
client = yes
; Service-level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept = 3307
connect = 192.168.1.6:3307
On 192.168.1.6
----------------------
pid = /var/stunnel.pid
setuid =nobody
setgid = nobody
foreground = yes
client = no
; Service-…
[View More]level configuration
[pop3s]
accept = 995
connect = 110
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 465
connect = 25
[mysqls]
accept =3307
connect =3306
connecting like
/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p -P 3307
Enter password:
On entring password the following lines appear :
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104
Subrata
----- Original Message -----
From: Brian Hatch <bri(a)stunnel.org>
To: subrata(a)indiatimes.com
Sent: Sun, 7 Oct 2007 10:02:17 +0530 (IST)
Subject: Re: [stunnel-users] Stunnel on the same machine
Near 2007-10-05 22:17 +0530, subrata(a)indiatimes.com insisted:
> After starting stunnel and connecting the mysql client/usr/local/mysql/bin/mysql -h 127.0.0.1 -u root -p the flow gets stuck at the Enter password prompt any suggestions how to proceed from there.
What do your stunnel configuration files look like?
Other problem: mysql client may decide to use a local domain socket when
connecting to localhost, thwarting your attempts to go via Stunnel.
You might want to 'strace mysql ...' and look for the connect() lines.
--
Brian Hatch Time flies like an
Systems and arrow. Fruit flies
Security Engineer like a banana.
http://www.ifokr.org/bri/
Every message PGP signed
--
My life has changed. What about yours?
Log on to the new Indiatimes Mail and Live out of the Inbox!
[View Less]
Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted:
> Researching online one can see that WebDAV's spec requires that they
> check both src and dest URLs for protocol & port. But with some proxies or
> SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as
> http and the other as https. Here's one person explaining it, much better
> than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml
Stunnel doesn't currently have the ability to …
[View More]scan and re-write the
plaintext. For HTTP redirects it could possibly be implemented
(re-write only the response before ^$, and redirects aren't chunked
and don't have content lengths to work with, etc) but you'd still
need enough HTTP logic to handle keepalives and such. It's not
trivial and not likely.
Another option would be to have something already HTTP aware doing
the rewriting in between stunnel and subversion. A re-writing
proxy.
Another option would be to use mod_rewrite in apache to rewrite
the urls.
But the best way would be to just use SSL inside apache and drop
stunnel entirely.
--
Brian Hatch The best way to accelerate
Systems and a Windows machine is at
Security Engineer 9.8 meters per second
http://www.ifokr.org/bri/ squared.
Every message PGP signed
[View Less]
Hello,
I am trying to avoid LD_LIBRARY_PATH and thus want to compile in the run time library path. I have tried various options to configure, hacking the LDFLAGS and CC lines in the Makefile, changing libtool varialbes, etc. but my resulting binary never has the library path inside.
Things I have tried:
LDFLAGS=-R/app/versions/local/3/lib
LDFLAGS=-L/app/versions/local/3/lib
LDFLAGS=-Wl,--rpath -Wl,/app/versions/local/3/lib
libtool variables that seem related but I cannot figure out:
…
[View More]hardcode_minus_L=yes
hardcode_libdir_flag_spec="\${wl}--rpath \${wl}\$libdir"
I am using stunnel-4.27 and the configure and libtool it contains.
Here is the output of gcc -v:
Reading specs from /app/versions/local/3/lib/gcc/i386-pc-solaris2.10/3.4.5/specs
Configured with: /opt/autobuild/workdir/gcc-3.4.5/configure --prefix=/app/versions/devtools/3 --with-gnu-ld --with-ld=/app/versions/devtools/3/bin/ld --with-gnu-as --with-as=/app/versions/devtools/3/bin/as --libdir=/app/versions/local/3/lib --with-local-prefix=/app/versions/local/3 --with-gxx-include-dir=/app/versions/local/3/include/c++ --enable-languages=c,c++,objc
Thread model: posix
gcc version 3.4.5
I am having the same issue with Solaris 10 on i86pc and sparc architectures.
Here is the last bit of my make output:
/bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/app/versions/local/3/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/app/versions/local/3/lib -lssl -lcrypto
gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/app/versions/local/3/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/app/versions/local/3/lib -lssl -lcrypto
The libtool line should show my rpath setting, I think. How do I get libtool to honor the rpath settings? Should I be asking the libtool maintainers?
I check the resulting binary using "strings stunnel | grep app" and my library directory never shows up.
Many thanks in advance.
-Jay Martel
_________________________________________________________________
Windows Live: Make it easier for your friends to see what you’re up to on Facebook.
http://windowslive.com/Campaign/SocialNetworking?ocid=PID23285::T:WLMTAGL:O…
[View Less]
Thanks for the suggestion, I was able to make the necessary changes and pass the configure and make process. Unfortunately, after uploading and running the app, the app will not run:
# ls -al /tmp
-rwxrwxrwx 1 root root 2434012 Aug 12 01:44 stunnel
-rw-r--r-- 1 root root 1148 Aug 12 01:37 stunnel.conf
-rw-r--r-- 1 root root 1977 Aug 12 01:44 stunnel.pem
drwxr-xr-x 1 root root 0 Dec 31 1969 var
# cd /tmp
# ./stunnel
-sh: ./stunnel: …
[View More]not found
The file is obviously there, with execute permissions. What is failing??
Thank you
> checking for "/dev/ptmx"... configure: error: cannot check for file
> existence when cross compiling.
>
> Give me your suggestions.
Check that /dev/ptmx exists on your router; it does on my Buffalo router with
Tomato. If it does, then hack the configure script to force the test
to return
true. A search in the script for ptmx should take you right to the test.
Good luck,
Andrew.
--
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com!
[View Less]
I have been receiving errors when configuring Stunnel, which I intend to cross compile for use with my Linksys WRT54GL router (Tomato firmware). When passing ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp the configure process stops with an error.
Here is the complete output.
./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp
configure: WARNING: If you wanted to set the --build type, …
[View More]don't use --host.
If a cross compiler is detected then cross compile mode will be used.
configure: **************************************** initialization
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking for mipsel-linux-strip... mipsel-linux-strip
checking build system type... i686-pc-linux-gnu
checking host system type... mipsel-unknown-linux-gnu
checking for mipsel-linux-gcc... mipsel-linux-gcc
checking for C compiler default output file name... a.out
checking whether the C compiler works... yes
checking whether we are cross compiling... yes
checking for suffix of executables...
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether mipsel-linux-gcc accepts -g... yes
checking for mipsel-linux-gcc option to accept ISO C89... none needed
checking for style of include used by make... GNU
checking dependency style of mipsel-linux-gcc... gcc3
checking for a BSD-compatible install... /usr/bin/install -c
checking whether make sets $(MAKE)... (cached) yes
configure: **************************************** libtool
checking for a sed that does not truncate output... /bin/sed
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for ld used by mipsel-linux-gcc... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld
checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes
checking for /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld option to reload object files... -r
checking for BSD-compatible nm... /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B
checking whether ln -s works... yes
checking how to recognize dependent libraries... pass_all
checking how to run the C preprocessor... mipsel-linux-gcc -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking dlfcn.h usability... yes
checking dlfcn.h presence... yes
checking for dlfcn.h... yes
checking for mipsel-linux-g++... mipsel-linux-g++
checking whether we are using the GNU C++ compiler... yes
checking whether mipsel-linux-g++ accepts -g... yes
checking dependency style of mipsel-linux-g++... gcc3
checking how to run the C++ preprocessor... mipsel-linux-g++ -E
checking for mipsel-linux-g77... no
checking for mipsel-linux-xlf... no
checking for mipsel-linux-f77... no
checking for mipsel-linux-frt... no
checking for mipsel-linux-pgf77... no
checking for mipsel-linux-cf77... no
checking for mipsel-linux-fort77... no
checking for mipsel-linux-fl32... no
checking for mipsel-linux-af77... no
checking for mipsel-linux-xlf90... no
checking for mipsel-linux-f90... no
checking for mipsel-linux-pgf90... no
checking for mipsel-linux-pghpf... no
checking for mipsel-linux-epcf90... no
checking for mipsel-linux-gfortran... no
checking for mipsel-linux-g95... no
checking for mipsel-linux-xlf95... no
checking for mipsel-linux-f95... no
checking for mipsel-linux-fort... no
checking for mipsel-linux-ifort... no
checking for mipsel-linux-ifc... no
checking for mipsel-linux-efc... no
checking for mipsel-linux-pgf95... no
checking for mipsel-linux-lf95... no
checking for mipsel-linux-ftn... no
checking for g77... no
checking for xlf... no
checking for f77... no
checking for frt... no
checking for pgf77... no
checking for cf77... no
checking for fort77... no
checking for fl32... no
checking for af77... no
checking for xlf90... no
checking for f90... no
checking for pgf90... no
checking for pghpf... no
checking for epcf90... no
checking for gfortran... no
checking for g95... no
checking for xlf95... no
checking for f95... no
checking for fort... no
checking for ifort... no
checking for ifc... no
checking for efc... no
checking for pgf95... no
checking for lf95... no
checking for ftn... no
checking whether we are using the GNU Fortran 77 compiler... no
checking whether accepts -g... no
checking the maximum length of command line arguments... 1572864
checking command to parse /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B output from mipsel-linux-gcc object... ok
checking for objdir... .libs
checking for mipsel-linux-ar... mipsel-linux-ar
checking for mipsel-linux-ranlib... mipsel-linux-ranlib
checking for mipsel-linux-strip... (cached) mipsel-linux-strip
checking if mipsel-linux-gcc supports -fno-rtti -fno-exceptions... yes
checking for mipsel-linux-gcc option to produce PIC... -fPIC
checking if mipsel-linux-gcc PIC flag -fPIC works... yes
checking if mipsel-linux-gcc static flag -static works... yes
checking if mipsel-linux-gcc supports -c -o file.o... yes
checking whether the mipsel-linux-gcc linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
configure: creating libtool
appending configuration tag "CXX" to libtool
checking for ld used by mipsel-linux-g++... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld
checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes
checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes
checking for mipsel-linux-g++ option to produce PIC... -fPIC
checking if mipsel-linux-g++ PIC flag -fPIC works... yes
checking if mipsel-linux-g++ static flag -static works... yes
checking if mipsel-linux-g++ supports -c -o file.o... yes
checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes
checking dynamic linker characteristics... GNU/Linux ld.so
(cached) (cached) checking how to hardcode library paths into programs... immediate
appending configuration tag "F77" to libtool
configure: **************************************** types
checking for unsigned char... yes
checking size of unsigned char... 1
checking for unsigned short... yes
checking size of unsigned short... 2
checking for unsigned int... yes
checking size of unsigned int... 4
checking for unsigned long... yes
checking size of unsigned long... 4
checking for socklen_t... yes
configure: **************************************** PTY device files
checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling.
Give me your suggestions.
Thank you
--
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com!
[View Less]
Hi guys,
is there a way to install multiple stunnel instances as windows service?
Where could I change service name?
I get error: CreateService : the specified service already exists
--
best wishes,
Franjo Stipanovic
Hello dear community.
I faced some troubles for iphone:
I moved separate server from hardware to AWS Cloud with SSL certificate from
Register.com. It moved well, and phone application continue work with new
server without any problems.
Then I installed LoadBalancer (HAProxy and Stunnel) for it and moved
certificate with key from configs of Apache to config of stunnel. In PC
browser it continue works well, and shows me blue field near the URL as
trusted. But on iPhone browser it shows just "…
[View More]Untrusted server certificate".
Is there any difference for ssl certificate for stunnel and Apache?
I understand that there is very specific question, but would you have any
ideas about it?
*Config of stunnel:*
cert = /usr/local/etc/stunnel/stunnel.pem
chroot = /usr/local/var/lib/stunnel/
setuid = nobody
setgid = nobody
pid = /stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = stunnel.log
[https]
accept = 443
connect = 80
xforwardedfor=yes
TIMEOUTclose = 0
*Patch for stunnel*
http://haproxy.1wt.eu/download/patches/stunnel-4.22-xforwarded-for.diff
need to make work "xforwardedfor=yes"
*# stunnel -version*
stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006
Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
Global options
debug = 5
pid = /usr/local/var/run/stunnel/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
Service-level options
cert = /usr/local/etc/stunnel/stunnel.pem
ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH
key = /usr/local/etc/stunnel/stunnel.pem
session = 300 seconds
stack = 65536 bytes
sslVersion = SSLv3 for client, all for server
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
verify = none
*
# uname -a*
Linux domU-12-31-38-00-35-07 2.6.18-xenU-ec2-v1.0 #2 SMP Tue Feb 19 10:51:53
EST 2008 i686 athlon i386 GNU/Linux
*
# openssl version*
OpenSSL 0.9.8b 04 May 2006
*And logs from stunnel when iphone tryed to conenct*
2009.08.04 08:20:16 LOG7[31023:3081598672]: https accepted FD=15 from
24.5.77.143:58019
2009.08.04 08:20:16 LOG7[31023:3081550736]: https started
2009.08.04 08:20:16 LOG7[31023:3081550736]: FD 15 in non-blocking mode
2009.08.04 08:20:16 LOG7[31023:3081550736]: TCP_NODELAY option set on local
socket
2009.08.04 08:20:16 LOG7[31023:3081550736]: Waiting for a libwrap process
2009.08.04 08:20:16 LOG7[31023:3081550736]: Acquired libwrap process #0
2009.08.04 08:20:16 LOG7[31023:3081550736]: Releasing libwrap process #0
2009.08.04 08:20:16 LOG7[31023:3081550736]: Released libwrap process #0
2009.08.04 08:20:16 LOG7[31023:3081550736]: https permitted by libwrap from
24.5.77.143:58019
2009.08.04 08:20:16 LOG5[31023:3081550736]: https accepted connection from
24.5.77.143:58019
2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept):
before/accept initialization
2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 read
client hello A
2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write
server hello A
2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write
certificate A
2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write
server done A
2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 flush
data
2009.08.04 08:20:16 LOG3[31023:3081550736]: SSL_accept: Peer suddenly
disconnected
2009.08.04 08:20:16 LOG5[31023:3081550736]: Connection reset: 0 bytes sent
to SSL, 0 bytes sent to socket
2009.08.04 08:20:16 LOG7[31023:3081550736]: https finished (0 left)
Thank you in advance,
Max
[View Less]