stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

stunnel 4.38 released
by Michal Trojnara 29 Jun '11

29 Jun '11

Dear Users, I have just released version 4.38 of stunnel. The ChangeLog entry: Version 4.38, 2011.06.28, urgency: MEDIUM: * New features - Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi". - "socket" option also accepts "yes" and "no" for flags. - Nagle's algorithm is now disabled by default for improved interactivity. * Bugfixes - A compilation fix was added for OpenSSL version < 1.0.0. - Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.38.tar.gz: aa49012195fde4dc3e4bed2bb25283cb40a6e0ad8295a47e730652f611e2268c Best regards, Mike

2 1

STunnel on 443 (ip1) and iis (443) on ip2?
by R. van der Gugten 27 Jun '11

27 Jun '11

Hi, Is it possible to run STunnel on my server to lisen to IP1 on port 443 And to have IIS listen to IP2 on port 443? Should I make changes in the config file? Thanks, Reinier Current server stunnel file: cert = stunnel.pem key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Authentication stuff verify = 2 CAfile = certs.pem ; Use it for client mode client = no ; Service-level configuration [SQLServer] accept = <<IP1:xxx.xxx.xxx.xxx>>:443 connect = 127.0.0.1:31433

2 1

Stuunnel Help
by Chris Pershin 24 Jun '11

24 Jun '11

Hello All, I am new to stunnel and am trying to solve a problem. When I try to start stunnel I get the following log file Reading configuration from file stunnel.conf PRNG seeded successfully Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL context initialized for service pop3s Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL context initialized for service imaps Certificate: stunnel.pem Certificate loaded Key file: stunnel.pem Private key loaded SSL context initialized for service ssmtp Configuration successful No limit detected for the number of clients accept socket: FD=164 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Service pop3s bound to 0.0.0.0:110 Service pop3s opened FD=164 accept socket: FD=188 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Service imaps bound to 0.0.0.0:143 Service imaps opened FD=188 accept socket: FD=196 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding ssmtp to 0.0.0.0:25 bind: No error (0) Server is down My Config file is: cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [pop3s] accept = 110 connect = pop.gmail.com:995 [imaps] accept = 143 connect = imap.gmail.com:993 [ssmtp] accept = 25 connect = smtp.gmail.com:465 Can someone please help me? Thanks Chris

2 1

Server-side SNI support
by Michal Trojnara 18 Jun '11

18 Jun '11

Dear Users, I'd like the next version of stunnel to support server-side Server Name Indication: https://secure.wikimedia.org/wikipedia/en/wiki/Server_Name_Indication The new service-level stunnel.conf option would be: sni = <master service>:<sni host> For example: [virtual] accept = 443 ; settings for clients that didn't send an SNI extension cert = default.pem connect = default.internal.mydomain.com:80 [sni1] ; notice that "sni" option is used instead of "accept" sni = virtual:server1.mydomain.com cert = server1.pem connect = server1.internal.mydomain.com:80 [sni2] sni = virtual:server2.mydomain.com cert = server2.pem connect = server2.internal.mydomain.com:80 ; other service-level options may be specified here verify = 3 CAfile = server2-allowed-clients.pem [sni3] sni = virtual:server3.mydomain.com cert = server3.pem connect = server3.internal.mydomain.com:80 I would appreciate your comments on the user interface I designed for this functionality. Best regards, Michal Trojnara

2 3

stunnel 4.37 released
by Michal Trojnara 17 Jun '11

17 Jun '11

Dear Users, I have just released version 4.37 of stunnel. This release is mainly intended to fix bugs and portability issues introduced in versions 4.35 and 4.36. This version also provides new security defaults, updated to better match current best practices in cryptographic applications. The ChangeLog entry: Version 4.37, 2011.06.17, urgency: MEDIUM: * New features - Client-side SNI implemented (RFC 3546 section 3.1). - Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:! SSLv2". - Recommended "options = NO_SSLv2" added to the sample stunnel.conf file. - Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option. - Improved --enable-fips and --disable-fips ./configure option handling. - On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch. * Bugfixes - Non-blocking socket handling in local mode fixed (Debian bug #626856). - UCONTEXT threading mode fixed. - Removed the use of gcc Thread-Local Storage for improved portability. - va_copy macro defined for platforms that do not have it. - Fixed "local" option parsing on IPv4 systems. - Solaris compilation fix (redefinition of "STR"). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.37.tar.gz: 02ca30609ccb26f6e52ff7eb79a6778ea452a04432eaef7d959d19933f6fe109 Best regards, Mike

1 0

stunnel-4.36 issues ("Operation now in progress")
by Schmidt, Bernhard 16 Jun '11

16 Jun '11

Hi, today our blessed Enterprise-class distribution SLES11.1 made a major upgrade from stunnel 4.27 to stunnel 4.36, which somewhat broke our monitoring agent. Config: ------ client = no pid = /var/run/stunnel.pid debug = 4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem [uptimeagent] accept = 9998 exec = /opt/uptime-agent/bin/uptimeagent ------ We get the following output when connecting: 2011.06.16 15:13:37 LOG7[4597:140226692765440]: local socket: FD=12 allocated (non-blocking mode) 2011.06.16 15:13:37 LOG7[4597:140226692765440]: Service uptimeagent accepted FD=12 from 10.156.10.160:55926 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Service uptimeagent started 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Option TCP_NODELAY set on local socket 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Waiting for a libwrap process 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Acquired libwrap process #0 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Releasing libwrap process #0 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Released libwrap process #0 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Service uptimeagent permitted by libwrap from 10.156.10.160:55926 2011.06.16 15:13:37 LOG5[4597:140226692757264]: Service uptimeagent accepted connection from 10.156.10.160:55926 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): before/accept initialization 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 read client hello A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write server hello A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write certificate A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write server done A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 flush data 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 read client key exchange A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 read finished A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write change cipher spec A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 write finished A 2011.06.16 15:13:37 LOG7[4597:140226692757264]: SSL state (accept): SSLv3 flush data 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 1 items in the session cache 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 client connects (SSL_connect()) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 client connects that finished 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 client renegotiations requested 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 1 server connects (SSL_accept()) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 1 server connects that finished 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 server renegotiations requested 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 session cache hits 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 external session cache hits 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 session cache misses 2011.06.16 15:13:37 LOG7[4597:140226692757264]: 0 session cache timeouts 2011.06.16 15:13:37 LOG6[4597:140226692757264]: SSL accepted: new session negotiated 2011.06.16 15:13:37 LOG6[4597:140226692757264]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2011.06.16 15:13:37 LOG7[4597:140226692757264]: socket#1: FD=13 allocated (non-blocking mode) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: socket#2: FD=14 allocated (non-blocking mode) 2011.06.16 15:13:37 LOG3[4597:140226692757264]: connect: Operation now in progress (115) 2011.06.16 15:13:37 LOG5[4597:140226692757264]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.06.16 15:13:37 LOG7[4597:140226692757264]: Service uptimeagent finished (0 left) 2011.06.16 15:13:37 LOG7[4597:140226692757264]: str_stats: 0 blocks, 0 bytes We did not see this in 4.27, 4.33 and 4.34, but we see it in a 3rd party 4.35 RPM. This suspiciously sounds like http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626856, and according to the changelog there is already a fix in the unreleased 4.37 version for this. - Could this in fact be the same bug? - Is the patch available somewhere? I could not find a source repository - Is there a workaround? Thanks, Bernhard

1 0

15 Jun '11

Hi everyone, I'm happily using stunnel for almost 8 years now :) I recently began to use verify=3 and i'm quite disappointed that a succesful access does not appear in the logs unless they are set to quite verbose. To be precise, i think it makes sense, for paranoid setups to keep track of successful accesses to. I'd suggest logging remote end's DN for log level =3 or 4. As there were some improvements lately in verify=3, i hope you could integrate this too. Thanks

2 1

STUNNEL 4.36 Windows - https - 404 Error
by Narasimhan Rangaswamy 13 Jun '11

13 Jun '11

Whenever I connect to "http://localhost:20010" I get the proper https repsonse from server "https://sslwebsite.xxxx.com". But the moment I add, "https://localhost:20010/someprogrampath", I get "404 File Not found error". But if I access, " https://sslwebsite.xxxx.com/someprogrampath" directly it WORKS. Any ideas? I use the following configuration. =================================== ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ;CApath = c:\certs ; It's often easier to use CAfile CAfile = c:\certs\MetavanteTest_client.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [https] cert = c:\certs\xxxx_client.pem accept = 20010 connect = sswebsite.xxxx.com:443 ;TIMEOUTclose = 0 ; vim:ft=dosini sslVersion = all =========================================

2 1

Re: [stunnel-users] How to make stunnel autorun on startup?
by Jack Liu 11 Jun '11

11 Jun '11

You got it! Thank you so much! Mr. Jack Subject: Re: [stunnel-users] How to make stunnel autorun on startup? To: jackliu92(a)hotmail.com From: josealf(a)rocketmail.com Date: Sat, 11 Jun 2011 04:17:05 +0000 Most likely it is in /usr/bin Update the script From: Jack Liu <jackliu92(a)hotmail.com> Date: Fri, 10 Jun 2011 21:24:22 -0600 To: <josealf(a)rocketmail.com>; <stunnel-users(a)stunnel.org> Subject: RE: [stunnel-users] How to make stunnel autorun on startup? Sorry, I just hit reply and forgot to add stunnel-users(a)stunnel.org I have the script, however, my system is centos and the following error occur when start stunnel service # service stunnel start Starting stunnel: /etc/init.d/stunnel: line 77: /usr/sbin/stunnel: No such file or directory Line 77 is: #Path to executable SEXE=/usr/sbin/stunnel I have no idea where my stunnel executable is. Thank you! Mr. Jack > Subject: Re: [stunnel-users] How to make stunnel autorun on startup? > To: jackliu92(a)hotmail.com; stunnel-users-bounces(a)stunnel.org; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sat, 11 Jun 2011 02:38:26 +0000 > > Jack, > > On which platform? > On Red Hat and derived distributions, You copy the stunnel startup script to the /etc/init.d directory and set it to run at startup with the chkconfig command. > > Assuming your stunnel startup script is stunnel, you do > > /sbin/chkconfig stunnel on > > You can find an init script in the stunnel source package. > > Regards, > > Jose > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Fri, 10 Jun 2011 20:06:48 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] How to make stunnel autorun on startup? > >_______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

How to make stunnel autorun on startup?
by Jack Liu 11 Jun '11

11 Jun '11

How do you make stunnel autorun on startup? Mr. Jack

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users