stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Jose Alf. 03 May '11

03 May '11

Laurent, I'm not sure you are connecting the dots right. I see an stunnel server configuration. In this case, your stunnel is a front-end to a service you run on host XXXX port 10016. What is that service? Is stunnel running on the same host? Note that If stunnel is not running on the same host with IP XXXX, then you may have some traffic in clear text in your network (from the device running stunnel to the device hosting the service on port 10016). You need a client to connect to the stunnel server. Unless your client support SSL natively, you also should have an stunnel running on your client device with entries like these: client=yes [pestip] accept = 10443 connect = Your-Stunnel-server-IP:10443 In this case your client apps connects locally to port 10443, traffic is encrypted and sent to your server listening on port 10443, where it is decripted and send to IP XXXX port 10016. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tue, May 3, 2011 10:48:11 AM Subject: Réf. : Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Re: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by Leandro Avila 03 May '11

03 May '11

Hi, If you have control of both ends of the connection make sure your SSL version is consistent on both sides. I would not recomend using sslVersion = all Either set it to SSLv3 or TLSv1 DES-CBC-SHA is supported under those However, judging for the cipher you are choosing I assume you might be dealing with a legacy application and you might not have access to both ends of the connection. I would try setting only one version at the time and moving down from TLSv1, SSLv3 and SSLv2 sslVersion = ciphers = DES-CBC-SHA Cheers ----------------- Leandro Avila ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: josealf(a)rocketmail.com Cc: stunnel-users(a)stunnel.org; stunnel-users-bounces(a)stunnel.org Sent: Tuesday, May 3, 2011 10:48 AM Subject: [stunnel-users] Réf. : Re: need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Dear Jose, here is the configuration file of my stunnel : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv2 sslVersion = all ;ciphers = DES-CBC-SHA ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXX:10016 Thanks for your help. Regards. Laurent UK Internet josealf(a)rocketmail.com 03/05/2011 14:52 Veuillez répondre à josealf(a)rocketmail.com Pour Laurent UK, stunnel-users-bounces(a)stunnel.org, stunnel-users(a)stunnel.org cc Objet Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

stunnel 4.36 released
by Michal Trojnara 03 May '11

03 May '11

Dear Users, Version 4.36 of stunnel was released. The ChangeLog entry: Version 4.36, 2011.05.03, urgency: LOW: * New features - Updated Win32 DLLs for OpenSSL 1.0.0d. - Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. - Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). - Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. - Example tools/stunnel.service file added for systemd service manager. * Bugfixes - Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). - Fixed the incorrect way of setting FD_CLOEXEC flag. - Fixed --enable-libwrap option of ./configure script. - /opt/local added to OpenSSL search path for MacPorts compatibility. - Workaround implemented for signal handling on MacOS X. - A trivial bug fixed in the stunnel.init script. - Retry implemented on EAI_AGAIN error returned by resolver calls. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.36.tar.gz: 3483fc2011e8a9d2614a93a9dbf7eabf405044df3566f29144fe2d1dd37a35f5 Best regards, Mike

3 2

Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by josealf＠rocketmail.com 03 May '11

03 May '11

Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Temporary failure in name resolution (Michal Trojnara)
by Phil Wieland 29 Apr '11

29 Apr '11

I attach two strace reports, strace-good shows a successful use, strace-bad shows it failing after a reboot. In both cases I just telnet to localhost 55899, which gives the smtp server's banner in the good case. ltrace craps out with a [pid 1107] +++ killed by SIGTRAP +++ in both cases, and doesn't show anything useful. These are WITHOUT the suggested patch, I am not really equipped for building on this server. Phil

2 1

Re: [stunnel-users] Réf. : Re: Tr : Réf. : Re: Need some informations about stunnel(AC,?crl ?files)
by Ludolf Holzheid 29 Apr '11

29 Apr '11

On Fri, 2011-04-29 15:39:45 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf thank you for your response. > > I have another question. > > Is it possible to have 2 stunnel running on the same server? > > 1 stunnel with no client's certificate verification (verify = 0) with a > specific port > > and 1 stunnel with client's certificate verification (verify = 3) with > other specific port You may run as many instances of stunnel as you like, as long as they don't share listening ports (accept=...) or pid files (pid=...). Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Tr : Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 28 Apr '11

28 Apr '11

On Thu, 2011-04-28 17:06:28 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf i need some help with the verify option. > > I want to check the certificate client in my machine and also check if the > certificate's client is in the crl list. > > You said that " > If you are using verify=3, stunnel checks client certificates against > the set of certificates in CApath or CAfile, not against CAs and CRLs." > > Is it possible to check client certificates with certificates in CaPath > and also with CRls? Laurent, By installing a certificate (to CApath or CAfile), you express your trust in the certificate. For the client certificates, you could either o implicitly trust all certificates signed by an installed CA certificate and not yet revoked (verify=2), or o explicitly trust installed client certificates (verify=3). In both cases, all installed certificates are fully trusted. Cross-checking a trusted (client-) certificate against an other trusted (CA-) certificate does not raise security or trustworthiness. In order to revoke a client certificate in verify=3 mode, just uninstall it. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Delay before sending server hello
by Dan Price 28 Apr '11

28 Apr '11

I am using stunnel to accept TLS connections. I'm opening eight connections at virtually the same time, and occasionally see that for one of the connections, the handshake does not complete - stunnel does not send the server hello, and the client usually resets the connection. I did manage to capture one instance where stunnel sends the server hello, but it is delayed by over a minute. I upgraded to version 4.35, and I see the same behavior. I set debug=debug, and captured what I think are the relevant logs (through write server hello). I kept the logs for the successful connection (59924) that came in after the failed one (59923). Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=15 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=15 from ::ffff:10.50.2.11:59923 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=16 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=16 from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Acquired libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Releasing libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Released libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG5[10357:1433471888]: Service msrp accepted connection from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): before/accept initialization Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 read client hello A Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 write server hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Acquired libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Releasing libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Released libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG5[10357:1431989136]: Service msrp accepted connection from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): before/accept initialization Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 read client hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 write server hello A Thanks, Dan

1 0

Does stunnel support startTLS?
by Markus Borst 28 Apr '11

28 Apr '11

Stunnel supports encryption in the "old" ssl style extra port configuration (i.e. imaps on port 993) where the encryption is negotiated immediately upon start of the connection. Does stunnel also support the startTLS method? i.e. a clear text connection is established (imap on port 143) and one of the first imap commands is startTLS, which negotiates the encryption and protects the connection from that time onwards. I know that supporting startTLS is a lot harder, since it means sniffing commands in the higher level protocol, but we need it nevertheless. (In fact, our imap server does support startTLS, but it does _not_ support importing an external certificate, which is why I'm looking for an external solution.) From reading the documentation I'm not sure whether stunnel supports startTLS, there are a few option descriptions which might point to startTLS, but I'm not sure. Anybody knows the definite answer? Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersenstrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 3

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 28 Apr '11

28 Apr '11

Thx for continuing reply my msg, Yes, there is var/log/messages Inside there only has some iptables log, FTP, SMTP application log and nothing else. I am positive that this problem is not cause by iptables, becuase I tried with iptables off. Nothing else related to stunnel is found in that folder. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 20:00:30 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > I guess in centos that's /var/log/messages > but in general, you should probably check everything in /var/log to make sure. > > On Mon, Apr 25, 2011 at 5:38 PM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > Thank you for helping, but both logs r not presented in my var/log/ dir. Any > > other suggestions? > > > > > > Mr. Jack > > > > > > > > > > > >> From: sunyucong(a)gmail.com > >> Date: Mon, 25 Apr 2011 16:25:20 -0700 > >> Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): > >> before/accept initialization > >> To: jackliu92(a)hotmail.com > >> CC: stunnel-users(a)stunnel.org > >> > >> Are you sure that's entire log? check /var/log/daemons.log and > >> syslog.log as well. > >> > >> On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > >> > It anyone knows how to fix Stunnel stuck at SSL state (accept): > >> > before/accept initialization??? > >> > > >> > Here is the log: > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes > >> > to > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims > >> > sufficient > >> > entropy for the PRNG > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > >> > /etc/stunnel/CA > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > >> > /etc/stunnel/CRL > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > >> > service 3proxy > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > >> > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > >> > Sockets:POLL,IPv6 Auth:LIBWRAP > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > >> > changed with 'ulimit -n') > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > >> > limit for file descriptors > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > >> > accept socket > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to > >> > 0.0.0.0:30001 > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > >> > /var/run/stunnel.pid > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > >> > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > >> > with code 0 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > >> > xx.xxx.xxx.xx:41165 permitted by libwrap > >> > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > >> > before/accept initialization <-----------------------Stuck here > >> > forever!!! > >> > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > >> > disconnected > >> > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes > >> > sent > >> > to SSL, 0 bytes sent to socket > >> > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > >> > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; > >> > terminating > >> > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > >> > /var/run/stunnel.pid > >> > [root@vps1 ~]# > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > stunnel.conf: > >> > cert = /etc/stunnel/stunnel.pem > >> > key = /etc/stunnel/stunnel.pem > >> > CApath = /etc/stunnel/CA > >> > CRLpath = /etc/stunnel/CRL > >> > debug = 7 > >> > foreground = yes > >> > verify = 1 > >> > # > >> > [3proxy] > >> > accept = 30001 > >> > connect = 127.0.0.1:33135 > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > > >> > I am hosting with CentOS 5.5, and installed Stunnel via yum. > >> > Planning to use it with 3Proxy. However I experience the problem above, > >> > can > >> > someone please help with that? > >> > Thank you very much! > >> > > >> > > >> > > >> > Mr. Jack > >> > > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)stunnel.org > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > > >

3 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users