- stunnel-users - stunnel.org

Slow connection to remote stunnel
by Thorsten Kampe 31 May '11

31 May '11

Hi, I'm using stunnel 4.36 on Linux to secure Samba SWAT. When I connect directly to the remot stunnel port with my browser on Windows 7 (https://swat-server:stunnel-port) I get a long delay after entering my credentials (about 60 seconds or so). This seems to be known issue (for instance see "You will be prompted for the Linux root user username and password. There will be a delay of about 60 to 75 seconds with each login."[1].) I did a Wireshark trace and it seems that the server simply does not respond during that time. But when I connect to the local stunnel client (http://localhost:stunnel-port) the SWAT page displays immediately. Is that "normal". How can I get the same speed without a stunnel client? Thorsten [1] <http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_: _Ch10_:_Windows,_Linux,_and_Samba#Test_The_Secure_SWAT_Login>

2 1

stunnel cannot exec SWAT
by Thorsten Kampe 29 May '11

29 May '11

Hi, I'm successfully securing Samba SWAT on Linux with stunnel 4.36. The connection goes like this: browser -> http://localhost:901 (stunnel) -> remote:50901 (xinetd) -> stunnel -> remote:901 (xinetd) -> SWAT. Now I want to remove the xinetd swat file and have stunnel directly call swat: browser -> http://localhost:901 (stunnel) -> remote:50901 (xinetd) -> stunnel -> SWAT I do this by commenting out "connect" and setting exec and execargs (as documented in stunnel's man page): #connect = 901 exec = /usr/sbin/swat execargs = swat Now I get a "Connection closed by remote server" in my browser. The log shows this: [xinetd] START: swat-ssl pid=1026 from=192.168.0.253 [stunnel] Reading configuration from file /etc/stunnel/swat.xconf [stunnel] Could not load DH parameters from /etc/stunnel/stunnel.pem [stunnel] Configuration successful [stunnel] No limit detected for the number of clients [stunnel] stunnel 4.36 on i686-pc-linux-gnu with OpenSSL 1.0.0d 8 Feb 2011 [stunnel] Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL, IPv6 [stunnel] Service stunnel accepted connection from 192.168.0.253:60418 [stunnel] SSL accepted: new session negotiated [stunnel] Negotiated ciphers: ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 [stunnel] connect: Operation now in progress (115) [stunnel] Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket [stunnel] pid=1026 duration=0(sec) [xinetd] EXIT: swat-ssl status=0 pid=1026 duration=0(sec) The successful connection (when xinetd calls swat) looks like this: [xinetd] START: swat-ssl pid=5076 from=192.168.0.253 [everything as above] [stunnel] connect_blocking: connecting 127.0.0.1:901 [xinetd] START: swat pid=5085 from=127.0.0.1 [stunnel] connect_blocking: connected 127.0.0.1:901 [stunnel] Service stunnel connected remote server from 127.0.0.1:47098 [stunnel] SSL_shutdown successfully sent close_notify [stunnel] Connection closed: 288 bytes sent to SSL, 512 bytes sent to socket [xinetd] EXIT: swat status=0 pid=5085 duration=0(sec) [xinetd] EXIT: swat-ssl status=0 pid=5076 duration=0(sec) The only difference I can see is the "connect" in the problem case versus the "connect_blocking" in the success case. Who can shed some light? Thorsten

1 0

stunnel doing client cert authentication?
by Johann Smith 25 May '11

25 May '11

Hi, I have stunnel running as an https server. Can stunnel handle/validate client certificates in this mode? How are authentication details forwarded to the http backend, by additional headers? Thank you! Johann

2 1

During make of stunnel-4.36 on OSX: "str.c:83: error: thread-local storage not supported for this target"
by SciFi 24 May '11

24 May '11

Hello, During make, I suddenly got this, from the stunnel-4.36 tarball: > str.c:83: error: thread-local storage not supported for this target while it was compiling src/str.c . I'm running MacOSX 10.6.7 with Xcode-3.2.6. I always compile for i386 32-bit mode. (The kernel must be in 32-bit mode for this model iMac, even though most tasks will run in 64-bit mode.) The stunnel-4.34 was built and is (still) running fine here. (I must've skipped -4.35 for some reason.) The src/str.c does seem to be a new module in 4.36, however. I configure stunnel this way: $ ./configure \ --enable-dependency-tracking \ --enable-static \ --enable-shared \ --with-ssl=/usr/local/ssl (same configure with 4.34 & 4.36) The configure step found most things, including libwrap etc. They're using the same compiler and other flags etc.: $ $CC --version i686-apple-darwin10-gcc-4.2.1 (GCC) 4.2.1 (Apple Inc. build 5666) (dot 3) […] (I never use a pkg-mgr such as Macports or Fink; besides, they are both now back-level with stunnel.) I'm skeptical in upgrading Xcode to their 4.x series, with Apple's insistence we use the LLVM family there. ;) I'm just a hobbyist, using stunnel to connect Pan to NNTP servers thru their SSL services (including sending this message via Gmane). I am happy with 4.34 in this regard. If it's not too much trouble, though, could someone help further with this problem in 4.36, please? Thank you.

2 4

stunnel4 with exec as service for securing pop3
by Jörg-Volker Peetz 23 May '11

23 May '11

I would like to run the stunnel4 daemon in order to provide a pop3s service by using a pop server (solid-pop3d). The following configuration file doesn't work (the pop3 server doesn't start, I think) and I would like to ask for any hints. --stunnel.conf>>> cert = /etc/stunnel/stunnel4.pem sslVersion = SSLv3 [pop3s] accept = 995 exec = /usr/sbin/solid-pop3d execargs = solid-pop3d <<<stunnel.conf-- I would expect stunnel4 to start up solid-pop3d every time someone connects to port 995 and communicate to solid-pop3d, just like inetd would do, if configured to serve solid-pop3d. By the way, I have opened the service "pop3s" in /etc/hosts.allow. Thanks in advance for any help. -- Best regards, Jörg-Volker.

4 8

Re: [stunnel-users] problem with stunnel 4.36 (server mode), error after the 1st connexion
by Jose Alf. 15 May '11

15 May '11

Hi Laurent, Does it works fine with a previous version? If so, What's the lates version that works? If you google for "bind#1: Invalid argument (22) aix stunnel" you will find a mail thread with a similar issue. Regards, Jose ________________________________ From: "laurent.uk(a)bnpparibas.com" <laurent.uk(a)bnpparibas.com> To: stunnel-users(a)stunnel.org Sent: Fri, May 13, 2011 6:39:29 AM Subject: [stunnel-users] problem with stunnel 4.36 (server mode), error after the 1st connexion Hi everyone, i have installed the stunnel 4.36 today and now i have some errors... The 1st connexion is working fine : 011.05.13 13:23:44 LOG5[1802366:1]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel_server_level1.conf 2011.05.13 13:23:44 LOG7[1802366:1]: Snagged 64 random bytes from //.rnd 2011.05.13 13:23:44 LOG7[1802366:1]: Wrote 1024 new random bytes to //.rnd 2011.05.13 13:23:44 LOG7[1802366:1]: PRNG seeded successfully 2011.05.13 13:23:44 LOG7[1802366:1]: Using DH parameters from /opt/freeware/etc/stunnel/ca_nopass.pem 2011.05.13 13:23:44 LOG6[1802366:1]: DH initialized with 512 bit key 2011.05.13 13:23:44 LOG7[1802366:1]: ECDH initialized 2011.05.13 13:23:44 LOG7[1802366:1]: Certificate: /opt/freeware/etc/stunnel/ca_nopass.pem 2011.05.13 13:23:44 LOG7[1802366:1]: Certificate loaded 2011.05.13 13:23:44 LOG7[1802366:1]: Key file: /opt/freeware/etc/stunnel/ca_nopass.pem 2011.05.13 13:23:44 LOG7[1802366:1]: Private key loaded 2011.05.13 13:23:44 LOG7[1802366:1]: Verify directory set to /opt/freeware/etc/stunnel/CA_files/ 2011.05.13 13:23:44 LOG7[1802366:1]: Added /opt/freeware/etc/stunnel/CA_files/ revocation lookup directory 2011.05.13 13:23:44 LOG7[1802366:1]: Added /opt/freeware/etc/stunnel/CRL_files/ revocation lookup directory 2011.05.13 13:23:44 LOG5[1802366:1]: Peer certificate location /opt/freeware/etc/stunnel/CA_files/ 2011.05.13 13:23:44 LOG7[1802366:1]: SSL context initialized for service pesitip 2011.05.13 13:23:44 LOG5[1802366:1]: Configuration successful 2011.05.13 13:23:44 LOG5[1802366:1]: No limit detected for the number of clients 2011.05.13 13:23:44 LOG7[1802366:1]: signal_pipe: FD=4 allocated (blocking mode) 2011.05.13 13:23:44 LOG7[1802366:1]: signal_pipe: FD=5 allocated (blocking mode) 2011.05.13 13:23:44 LOG7[1802366:1]: accept socket: FD=6 allocated (non-blocking mode) 2011.05.13 13:23:44 LOG7[1802366:1]: Option SO_REUSEADDR set on accept socket 2011.05.13 13:23:44 LOG7[1802366:1]: Service pesitip bound to 0.0.0.0:10443 2011.05.13 13:23:44 LOG7[1802366:1]: Service pesitip opened FD=6 2011.05.13 13:23:44 LOG7[1802366:1]: Created pid file /var/adm/stunnel_server_level1.pid 2011.05.13 13:23:44 LOG5[1802366:1]: stunnel 4.36 on powerpc-ibm-aix5.2.0.0 with OpenSSL 0.9.8k 25 Mar 2009 2011.05.13 13:23:44 LOG5[1802366:1]: Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL, IPv6 2011.05.13 13:28:36 LOG7[1802366:1]: local socket: FD=7 allocated (non-blocking mode) 2011.05.13 13:28:36 LOG7[1802366:1]: Service pesitip accepted FD=7 from 10.254.181.230:2991 2011.05.13 13:28:36 LOG7[1802366:258]: Service pesitip started 2011.05.13 13:28:36 LOG7[1802366:258]: Option TCP_NODELAY set on local socket 2011.05.13 13:28:36 LOG5[1802366:258]: Service pesitip accepted connection from 10.254.181.230:2991 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): before/accept initialization 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 read client hello A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 write server hello A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 write certificate A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 write certificate request A 2011.05.13 13:28:36 LOG7[1802366:258]: SSL state (accept): SSLv3 flush data 2011.05.13 13:28:37 LOG7[1802366:258]: Starting certificate verification: depth=1, /O=SWIFT 2011.05.13 13:28:37 LOG5[1802366:258]: Certificate accepted: depth=1, /O=SWIFT 2011.05.13 13:28:37 LOG7[1802366:258]: Starting certificate verification: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:28:37 LOG5[1802366:258]: Certificate accepted: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read client certificate A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read client key exchange A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read certificate verify A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 read finished A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 write change cipher spec A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 write finished A 2011.05.13 13:28:37 LOG7[1802366:258]: SSL state (accept): SSLv3 flush data 2011.05.13 13:28:37 LOG7[1802366:258]: 1 items in the session cache 2011.05.13 13:28:37 LOG7[1802366:258]: 0 client connects (SSL_connect()) 2011.05.13 13:28:37 LOG7[1802366:258]: 0 client connects that finished 2011.05.13 13:28:37 LOG7[1802366:258]: 0 client renegotiations requested 2011.05.13 13:28:37 LOG7[1802366:258]: 1 server connects (SSL_accept()) 2011.05.13 13:28:37 LOG7[1802366:258]: 1 server connects that finished 2011.05.13 13:28:37 LOG7[1802366:258]: 0 server renegotiations requested 2011.05.13 13:28:37 LOG7[1802366:258]: 0 session cache hits 2011.05.13 13:28:37 LOG7[1802366:258]: 0 external session cache hits 2011.05.13 13:28:37 LOG7[1802366:258]: 0 session cache misses 2011.05.13 13:28:37 LOG7[1802366:258]: 0 session cache timeouts 2011.05.13 13:28:37 LOG6[1802366:258]: SSL accepted: new session negotiated 2011.05.13 13:28:37 LOG6[1802366:258]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2011.05.13 13:28:37 LOG7[1802366:258]: remote socket: FD=8 allocated (non-blocking mode) 2011.05.13 13:28:37 LOG6[1802366:258]: connect_blocking: connecting 159.50.5.165:10016 2011.05.13 13:28:37 LOG5[1802366:258]: connect_blocking: connected 159.50.5.165:10016 2011.05.13 13:28:37 LOG5[1802366:258]: Service pesitip connected remote server from 159.50.5.165:52585 2011.05.13 13:28:37 LOG7[1802366:258]: Remote FD=8 initialized 2011.05.13 13:28:37 LOG7[1802366:258]: Option TCP_NODELAY set on remote socket 2011.05.13 13:31:25 LOG7[1802366:258]: SSL alert (read): warning: close notify 2011.05.13 13:31:25 LOG7[1802366:258]: SSL closed on SSL_read 2011.05.13 13:31:25 LOG7[1802366:258]: Sending socket write shutdown 2011.05.13 13:31:25 LOG3[1802366:258]: readsocket: Connection reset by peer (73) 2011.05.13 13:31:25 LOG5[1802366:258]: Connection reset: 275 bytes sent to SSL, 17935 bytes sent to socket 2011.05.13 13:31:25 LOG7[1802366:258]: Service pesitip finished (0 left) 2011.05.13 13:31:25 LOG7[1802366:258]: str_stats: 36 blocks, 4350 bytes but when its the second i always have the error : 011.05.13 13:32:19 LOG7[1802366:1]: local socket: FD=7 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG7[1802366:1]: Service pesitip accepted FD=7 from 10.254.181.230:3007 2011.05.13 13:32:19 LOG7[1802366:259]: Service pesitip started 2011.05.13 13:32:19 LOG7[1802366:259]: Option TCP_NODELAY set on local socket 2011.05.13 13:32:19 LOG5[1802366:259]: Service pesitip accepted connection from 10.254.181.230:3007 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): before/accept initialization 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read client hello A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write server hello A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write certificate A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write certificate request A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 flush data 2011.05.13 13:32:19 LOG7[1802366:259]: Starting certificate verification: depth=1, /O=SWIFT 2011.05.13 13:32:19 LOG6[1802366:259]: CERT: Verification not enabled 2011.05.13 13:32:19 LOG5[1802366:259]: Certificate accepted: depth=1, /O=SWIFT 2011.05.13 13:32:19 LOG7[1802366:259]: Starting certificate verification: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:32:19 LOG6[1802366:259]: CERT: Verification not enabled 2011.05.13 13:32:19 LOG5[1802366:259]: Certificate accepted: depth=0, /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read client certificate A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read client key exchange A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read certificate verify A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 read finished A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write change cipher spec A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 write finished A 2011.05.13 13:32:19 LOG7[1802366:259]: SSL state (accept): SSLv3 flush data 2011.05.13 13:32:19 LOG7[1802366:259]: 2 items in the session cache 2011.05.13 13:32:19 LOG7[1802366:259]: 0 client connects (SSL_connect()) 2011.05.13 13:32:19 LOG7[1802366:259]: 0 client connects that finished 2011.05.13 13:32:19 LOG7[1802366:259]: 0 client renegotiations requested 2011.05.13 13:32:19 LOG7[1802366:259]: 2 server connects (SSL_accept()) 2011.05.13 13:32:19 LOG7[1802366:259]: 2 server connects that finished 2011.05.13 13:32:19 LOG7[1802366:259]: 0 server renegotiations requested 2011.05.13 13:32:19 LOG7[1802366:259]: 0 session cache hits 2011.05.13 13:32:19 LOG7[1802366:259]: 0 external session cache hits 2011.05.13 13:32:19 LOG7[1802366:259]: 0 session cache misses 2011.05.13 13:32:19 LOG7[1802366:259]: 0 session cache timeouts 2011.05.13 13:32:19 LOG6[1802366:259]: SSL accepted: new session negotiated 2011.05.13 13:32:19 LOG6[1802366:259]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2011.05.13 13:32:19 LOG7[1802366:259]: socket#1: FD=8 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG7[1802366:259]: socket#2: FD=9 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG7[1802366:259]: bind#1: Invalid argument (22) 2011.05.13 13:32:19 LOG7[1802366:259]: bind#2: Invalid argument (22) 2011.05.13 13:32:19 LOG7[1802366:259]: accept: FD=10 allocated (non-blocking mode) 2011.05.13 13:32:19 LOG6[1802366:259]: Local mode child started (PID=614488) 2011.05.13 13:32:19 LOG7[1802366:259]: Remote FD=10 initialized 2011.05.13 13:32:19 LOG7[1802366:259]: Option TCP_NODELAY set on remote socket 2011.05.13 13:32:19 LOG3[1802366:259]: transfer: s_poll_wait: Invalid argument (22) 2011.05.13 13:32:19 LOG3[614488:259]: : No such file or directory (2) 2011.05.13 13:32:19 LOG5[1802366:259]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket my configuration file is : ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/freeware/etc/stunnel/ca_nopass.pem foreground = yes syslog = yes ; Protocol version (all, SSLv2, SSLv3, TLSv1) ;sslVersion = SSLv3 sslVersion = all ;ciphers = DES-CBC-SHA: ;ciphers = DES-CBC3-SHA:IDEA-CBC-MD5 ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/stunnel/var/lib/stunnel ;chroot = /tmp/ ;setuid = root ;setgid = other ; PID is created inside chroot jail pid = /var/adm/stunnel_server_level1.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ;options = Options_SSL ; Authentication stuff verify = 3 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ ; It's often easier to use CAfile ;CAfile = /opt/freeware/etc/stunnel/ca.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail CRLpath = /opt/freeware/etc/stunnel/CRL_files/ ; Alternatively you can use CRLfile ;CRLfile = /usr/local/stunnel/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = no ; Service-level configuration [pesitip] accept = 10443 connect = XXXXXXXXXXXXX:10016 Can you help me to find a solution for this problem please? Thanks you very much. Laurent UK This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. Do not print this message unless it is necessary, consider the environment. --------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, BNP PARIBAS (et ses filiales) decline(nt) toute responsabilite au titre de ce message, dans l'hypothese ou il aurait ete modifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

stunnel 4.36 compilation problems with Sun Studio compiler
by Ross Richardson 11 May '11

11 May '11

There are several minor problems using the Sun Studion 12 compiler (on Solaris 10 SPARC)... - in str.c, use of STR causes errors because /usr/include/sys/stropts.h contains: #define STR ('S'<<8) The this just requires replacing "STR" with something safer, such as "XSTR". - things fail horribly because SIZEOF_UNSIGNED_CHAR and friends get defined to 0. AFAICT, this happens because configure erroneously decides that cc suports -pendantic (which it appears to, but which causes linking to fail with the symbol "mcount" undefined). The following patch works around this: Index: configure --- configure.orig 2011-05-03 08:14:28.000000000 +1000 +++ configure 2011-05-04 13:51:53.785750000 +1000 @@ -4210,7 +4210,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ /* end confdefs.h. */ int main() {return 0;} _ACEOF -if ac_fn_c_try_compile "$LINENO"; then : +if ac_fn_c_try_link "$LINENO"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else - the compiler also gives warnings for the '\r' characters in version.h Hope this helps, rlr -- Ross L Richardson <URL:mailto:Ross.Richardson@utas.edu.au> Senior Systems Administrator Phone : +61 (0)3 6226 6233 Information Technology Resources Fax : +61 (0)3 6226 7171 University of Tasmania, AUSTRALIA

2 4

stunnel high load and lower network I/O yields
by jay＠experts-exchange.com 10 May '11

10 May '11

Folks, We are finding a bottleneck with stunnel for video intensive apps where it will run with weighted CPU near 120% and network interface will yield 30.3Mb, whereas without stunnel the rates will top off near 53.1Mb during the 10 second intervals as reported by iftop. The peaks are higher, but this is not sustained for either case. In order to improve stunnel's performance, is it possible to use a less intensive compute processing encryption, or fork the stunnel per connection? Thanks

2 1

Re: [stunnel-users] Temporary failure in name resolution, (Michal Trojnara)
by Phil Wieland 08 May '11

08 May '11

On 30/04/11 11:00, stunnel-users-request(a)stunnel.org wrote: > > Your stunnel.conf contains: > chroot = /var/lib/stunnel4/ > > Unfortunately this directory does not contain resolver configuration > files: [] >> > These are WITHOUT the suggested patch, I am not really equipped for >> > building on this server. > The patch should solve your problem by causing stunnel to wait until your > resolver is available before chroot(2) is executed. > > Workarounds: > 1. mkdir /var/lib/stunnel4/etc&& cp /etc/resolv.conf > /var/lib/stunnel4/etc/ > 2. Use IP address instead of host names in your stunnel.conf > 3. Add static IP address of your remote host to /etc/hosts > > Best regards, > Mike > > Many thanks for the analysis, Mike. I'll have to organise myself to build so I can apply the patch. Can I be really cheeky and ask one more question? Why does the problem not go away when my resolver is available - Shouldn't stunnel look again for this stuff after getting a temporary error? Thanks again, Phil

2 2

UTF-8 Compatibility
by RetailDecisions 06 May '11

06 May '11

Hi, Can someone tell me from what version of STUNNEL is fully UTF-8 compatible? -- View this message in context: http://old.nabble.com/UTF-8-Compatibility-tp31559422p31559422.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0